Analysis
- max time kernel
131s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 15:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_3a3866bd49c4528c48c656b2cd72e23c_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_3a3866bd49c4528c48c656b2cd72e23c_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-10_3a3866bd49c4528c48c656b2cd72e23c_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260710-ssvm2sbz7p
- SHA256 61b1a86bb13273ef0cbdb320fe109147ca408378d6363cec7a6136a98b508e40
- MD5 3a3866bd49c4528c48c656b2cd72e23c
- SHA1 87511667bc14f39712f8a62a0a6967c1a9e0bbbe
- SHA512 4dfe9eb06c6231d3f30fd40e8608918a4711ac782262d6087615266a5bfbe05e70062c0d451efad8558a7661fb7b665d60be194114d104894e922e8a5144dfad
- SSDEEP 12288:wU5rCOTeiDIFbx3tIqRiRIswu5EtIHpNZ+3/v+I9hUG2VA:wUQOJDIzdiVw8JNGEA
- TLSH T1B9E4D02077D88536E9F7037859B5E6604D7EFD326722D6CF2B9025AE09B1BC09A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4596 4603.tmp 3324 470D.tmp 848 4855.tmp 3992 494F.tmp 4424 49BC.tmp 3672 4A78.tmp 5748 4C2D.tmp 6052 4D37.tmp 1412 4E02.tmp 2092 4F2B.tmp 5988 5054.tmp 1196 515D.tmp 4176 5267.tmp 1636 539F.tmp 692 5499.tmp 472 55C2.tmp 5884 5739.tmp 932 5872.tmp 4132 598B.tmp 2392 5A66.tmp 3064 5B9E.tmp 4916 5CA8.tmp 2720 5DA2.tmp 4868 5F29.tmp 2468 60AF.tmp 5736 619A.tmp 1480 6294.tmp 3056 63BC.tmp 1824 68BE.tmp 700 69C7.tmp 200 6B0F.tmp 3124 6C19.tmp 1716 6D52.tmp 4460 6DDE.tmp 1236 6E9A.tmp 2652 6F65.tmp 5692 7001.tmp 3432 70DC.tmp 2780 71A7.tmp 1268 7282.tmp 980 733D.tmp 3028 7418.tmp 4612 7502.tmp 4224 75AE.tmp 4740 763B.tmp 4152 7735.tmp 2896 7810.tmp 256 78DB.tmp 5408 7958.tmp 2472 79D5.tmp 5056 7A42.tmp 2816 7ADE.tmp 5556 7B5B.tmp 1140 7C07.tmp 5656 7C84.tmp 1816 7D11.tmp 1960 7D8E.tmp 4364 7E0B.tmp 3888 7EA7.tmp 2620 7F24.tmp 2240 7FA1.tmp 2860 801E.tmp 5684 809B.tmp 4888 8147.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 371A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 220B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F058.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 463D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2893.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9433.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 919E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C08D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E88C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D95A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E57F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 860A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D071.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F147.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D147.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D38D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4850.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C446.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4042.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E897.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F667.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 111E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F416.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93D0.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6028 wrote to memory of 4596 6028 2026-07-10_3a3866bd49c4528c48c656b2cd72e23c_elex_mafia_stealc_tofsee.exe 88 PID 4596 wrote to memory of 3324 4596 4603.tmp 89 PID 3324 wrote to memory of 848 3324 470D.tmp 90 PID 848 wrote to memory of 3992 848 4855.tmp 91 PID 3992 wrote to memory of 4424 3992 494F.tmp 92 PID 4424 wrote to memory of 3672 4424 49BC.tmp 93 PID 3672 wrote to memory of 5748 3672 4A78.tmp 94 PID 5748 wrote to memory of 6052 5748 4C2D.tmp 95 PID 6052 wrote to memory of 1412 6052 4D37.tmp 96 PID 1412 wrote to memory of 2092 1412 4E02.tmp 97 PID 2092 wrote to memory of 5988 2092 4F2B.tmp 98 PID 5988 wrote to memory of 1196 5988 5054.tmp 99 PID 1196 wrote to memory of 4176 1196 515D.tmp 100 PID 4176 wrote to memory of 1636 4176 5267.tmp 101 PID 1636 wrote to memory of 692 1636 539F.tmp 102 PID 692 wrote to memory of 472 692 5499.tmp 103 PID 472 wrote to memory of 5884 472 55C2.tmp 104 PID 5884 wrote to memory of 932 5884 5739.tmp 105 PID 932 wrote to memory of 4132 932 5872.tmp 106 PID 4132 wrote to memory of 2392 4132 598B.tmp 107 PID 2392 wrote to memory of 3064 2392 5A66.tmp 108 PID 3064 wrote to memory of 4916 3064 5B9E.tmp 109 PID 4916 wrote to memory of 2720 4916 5CA8.tmp 110 PID 2720 wrote to memory of 4868 2720 5DA2.tmp 111 PID 4868 wrote to memory of 2468 4868 5F29.tmp 112 PID 2468 wrote to memory of 5736 2468 60AF.tmp 113 PID 5736 wrote to memory of 1480 5736 619A.tmp 114 PID 1480 wrote to memory of 3056 1480 6294.tmp 115 PID 3056 wrote to memory of 1824 3056 63BC.tmp 116 PID 1824 wrote to memory of 700 1824 68BE.tmp 117 PID 700 wrote to memory of 200 700 69C7.tmp 118 PID 200 wrote to memory of 3124 200 6B0F.tmp 119 PID 3124 wrote to memory of 1716 3124 6C19.tmp 120 PID 1716 wrote to memory of 4460 1716 6D52.tmp 121 PID 4460 wrote to memory of 1236 4460 6DDE.tmp 122 PID 1236 wrote to memory of 2652 1236 6E9A.tmp 123 PID 2652 wrote to memory of 5692 2652 6F65.tmp 124 PID 5692 wrote to memory of 3432 5692 7001.tmp 125 PID 3432 wrote to memory of 2780 3432 70DC.tmp 126 PID 2780 wrote to memory of 1268 2780 71A7.tmp 127 PID 1268 wrote to memory of 980 1268 7282.tmp 128 PID 980 wrote to memory of 3028 980 733D.tmp 129 PID 3028 wrote to memory of 4612 3028 7418.tmp 130 PID 4612 wrote to memory of 4224 4612 7502.tmp 131 PID 4224 wrote to memory of 4740 4224 75AE.tmp 132 PID 4740 wrote to memory of 4152 4740 763B.tmp 133 PID 4152 wrote to memory of 2896 4152 7735.tmp 134 PID 2896 wrote to memory of 256 2896 7810.tmp 135 PID 256 wrote to memory of 5408 256 78DB.tmp 136 PID 5408 wrote to memory of 2472 5408 7958.tmp 137 PID 2472 wrote to memory of 5056 2472 79D5.tmp 138 PID 5056 wrote to memory of 2816 5056 7A42.tmp 139 PID 2816 wrote to memory of 5556 2816 7ADE.tmp 140 PID 5556 wrote to memory of 1140 5556 7B5B.tmp 141 PID 1140 wrote to memory of 5656 1140 7C07.tmp 142 PID 5656 wrote to memory of 1816 5656 7C84.tmp 143 PID 1816 wrote to memory of 1960 1816 7D11.tmp 144 PID 1960 wrote to memory of 4364 1960 7D8E.tmp 145 PID 4364 wrote to memory of 3888 4364 7E0B.tmp 146 PID 3888 wrote to memory of 2620 3888 7EA7.tmp 147 PID 2620 wrote to memory of 2240 2620 7F24.tmp 148 PID 2240 wrote to memory of 2860 2240 7FA1.tmp 149 PID 2860 wrote to memory of 5684 2860 801E.tmp 150 PID 5684 wrote to memory of 4888 5684 809B.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_3a3866bd49c4528c48c656b2cd72e23c_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_3a3866bd49c4528c48c656b2cd72e23c_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\4603.tmp"C:\Users\Admin\AppData\Local\Temp\4603.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\470D.tmp"C:\Users\Admin\AppData\Local\Temp\470D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\4855.tmp"C:\Users\Admin\AppData\Local\Temp\4855.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\494F.tmp"C:\Users\Admin\AppData\Local\Temp\494F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\49BC.tmp"C:\Users\Admin\AppData\Local\Temp\49BC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\4A78.tmp"C:\Users\Admin\AppData\Local\Temp\4A78.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\4D37.tmp"C:\Users\Admin\AppData\Local\Temp\4D37.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Users\Admin\AppData\Local\Temp\4E02.tmp"C:\Users\Admin\AppData\Local\Temp\4E02.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\4F2B.tmp"C:\Users\Admin\AppData\Local\Temp\4F2B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\5054.tmp"C:\Users\Admin\AppData\Local\Temp\5054.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\515D.tmp"C:\Users\Admin\AppData\Local\Temp\515D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\5267.tmp"C:\Users\Admin\AppData\Local\Temp\5267.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\539F.tmp"C:\Users\Admin\AppData\Local\Temp\539F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\5499.tmp"C:\Users\Admin\AppData\Local\Temp\5499.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\55C2.tmp"C:\Users\Admin\AppData\Local\Temp\55C2.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\5739.tmp"C:\Users\Admin\AppData\Local\Temp\5739.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\5872.tmp"C:\Users\Admin\AppData\Local\Temp\5872.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\598B.tmp"C:\Users\Admin\AppData\Local\Temp\598B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\5A66.tmp"C:\Users\Admin\AppData\Local\Temp\5A66.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\5B9E.tmp"C:\Users\Admin\AppData\Local\Temp\5B9E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\5CA8.tmp"C:\Users\Admin\AppData\Local\Temp\5CA8.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\5DA2.tmp"C:\Users\Admin\AppData\Local\Temp\5DA2.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\5F29.tmp"C:\Users\Admin\AppData\Local\Temp\5F29.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\60AF.tmp"C:\Users\Admin\AppData\Local\Temp\60AF.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\619A.tmp"C:\Users\Admin\AppData\Local\Temp\619A.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\6294.tmp"C:\Users\Admin\AppData\Local\Temp\6294.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\63BC.tmp"C:\Users\Admin\AppData\Local\Temp\63BC.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\68BE.tmp"C:\Users\Admin\AppData\Local\Temp\68BE.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\69C7.tmp"C:\Users\Admin\AppData\Local\Temp\69C7.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\6B0F.tmp"C:\Users\Admin\AppData\Local\Temp\6B0F.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\6C19.tmp"C:\Users\Admin\AppData\Local\Temp\6C19.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\6D52.tmp"C:\Users\Admin\AppData\Local\Temp\6D52.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\6DDE.tmp"C:\Users\Admin\AppData\Local\Temp\6DDE.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\6E9A.tmp"C:\Users\Admin\AppData\Local\Temp\6E9A.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\6F65.tmp"C:\Users\Admin\AppData\Local\Temp\6F65.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\7001.tmp"C:\Users\Admin\AppData\Local\Temp\7001.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\70DC.tmp"C:\Users\Admin\AppData\Local\Temp\70DC.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\7282.tmp"C:\Users\Admin\AppData\Local\Temp\7282.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\733D.tmp"C:\Users\Admin\AppData\Local\Temp\733D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\7418.tmp"C:\Users\Admin\AppData\Local\Temp\7418.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\7502.tmp"C:\Users\Admin\AppData\Local\Temp\7502.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\75AE.tmp"C:\Users\Admin\AppData\Local\Temp\75AE.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\763B.tmp"C:\Users\Admin\AppData\Local\Temp\763B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\7735.tmp"C:\Users\Admin\AppData\Local\Temp\7735.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\7810.tmp"C:\Users\Admin\AppData\Local\Temp\7810.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\78DB.tmp"C:\Users\Admin\AppData\Local\Temp\78DB.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\7958.tmp"C:\Users\Admin\AppData\Local\Temp\7958.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\79D5.tmp"C:\Users\Admin\AppData\Local\Temp\79D5.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\7A42.tmp"C:\Users\Admin\AppData\Local\Temp\7A42.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\7ADE.tmp"C:\Users\Admin\AppData\Local\Temp\7ADE.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\7B5B.tmp"C:\Users\Admin\AppData\Local\Temp\7B5B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\7C07.tmp"C:\Users\Admin\AppData\Local\Temp\7C07.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\7C84.tmp"C:\Users\Admin\AppData\Local\Temp\7C84.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\7D11.tmp"C:\Users\Admin\AppData\Local\Temp\7D11.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\7D8E.tmp"C:\Users\Admin\AppData\Local\Temp\7D8E.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\7E0B.tmp"C:\Users\Admin\AppData\Local\Temp\7E0B.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\7EA7.tmp"C:\Users\Admin\AppData\Local\Temp\7EA7.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\7F24.tmp"C:\Users\Admin\AppData\Local\Temp\7F24.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\7FA1.tmp"C:\Users\Admin\AppData\Local\Temp\7FA1.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\801E.tmp"C:\Users\Admin\AppData\Local\Temp\801E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\809B.tmp"C:\Users\Admin\AppData\Local\Temp\809B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\8147.tmp"C:\Users\Admin\AppData\Local\Temp\8147.tmp"65⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\81E3.tmp"C:\Users\Admin\AppData\Local\Temp\81E3.tmp"66⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\8260.tmp"C:\Users\Admin\AppData\Local\Temp\8260.tmp"67⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\82DD.tmp"C:\Users\Admin\AppData\Local\Temp\82DD.tmp"68⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\8389.tmp"C:\Users\Admin\AppData\Local\Temp\8389.tmp"69⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\8406.tmp"C:\Users\Admin\AppData\Local\Temp\8406.tmp"70⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\8473.tmp"C:\Users\Admin\AppData\Local\Temp\8473.tmp"71⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\84F0.tmp"C:\Users\Admin\AppData\Local\Temp\84F0.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\858D.tmp"C:\Users\Admin\AppData\Local\Temp\858D.tmp"73⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\860A.tmp"C:\Users\Admin\AppData\Local\Temp\860A.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\8687.tmp"C:\Users\Admin\AppData\Local\Temp\8687.tmp"75⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\8713.tmp"C:\Users\Admin\AppData\Local\Temp\8713.tmp"76⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\87A0.tmp"C:\Users\Admin\AppData\Local\Temp\87A0.tmp"77⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\881D.tmp"C:\Users\Admin\AppData\Local\Temp\881D.tmp"78⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\88AA.tmp"C:\Users\Admin\AppData\Local\Temp\88AA.tmp"79⤵PID:5776
-
C:\Users\Admin\AppData\Local\Temp\8955.tmp"C:\Users\Admin\AppData\Local\Temp\8955.tmp"80⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\89D2.tmp"C:\Users\Admin\AppData\Local\Temp\89D2.tmp"81⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\8A5F.tmp"C:\Users\Admin\AppData\Local\Temp\8A5F.tmp"82⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\8AEC.tmp"C:\Users\Admin\AppData\Local\Temp\8AEC.tmp"83⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\8B69.tmp"C:\Users\Admin\AppData\Local\Temp\8B69.tmp"84⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\8BE6.tmp"C:\Users\Admin\AppData\Local\Temp\8BE6.tmp"85⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\8C63.tmp"C:\Users\Admin\AppData\Local\Temp\8C63.tmp"86⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\8CE0.tmp"C:\Users\Admin\AppData\Local\Temp\8CE0.tmp"87⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\8D7C.tmp"C:\Users\Admin\AppData\Local\Temp\8D7C.tmp"88⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\8DE9.tmp"C:\Users\Admin\AppData\Local\Temp\8DE9.tmp"89⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\8E66.tmp"C:\Users\Admin\AppData\Local\Temp\8E66.tmp"90⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\8EF3.tmp"C:\Users\Admin\AppData\Local\Temp\8EF3.tmp"91⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\8F70.tmp"C:\Users\Admin\AppData\Local\Temp\8F70.tmp"92⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\8FDD.tmp"C:\Users\Admin\AppData\Local\Temp\8FDD.tmp"93⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\905A.tmp"C:\Users\Admin\AppData\Local\Temp\905A.tmp"94⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\90D7.tmp"C:\Users\Admin\AppData\Local\Temp\90D7.tmp"95⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\9145.tmp"C:\Users\Admin\AppData\Local\Temp\9145.tmp"96⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\91B2.tmp"C:\Users\Admin\AppData\Local\Temp\91B2.tmp"97⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\921F.tmp"C:\Users\Admin\AppData\Local\Temp\921F.tmp"98⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\929C.tmp"C:\Users\Admin\AppData\Local\Temp\929C.tmp"99⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\9329.tmp"C:\Users\Admin\AppData\Local\Temp\9329.tmp"100⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\93A6.tmp"C:\Users\Admin\AppData\Local\Temp\93A6.tmp"101⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\9433.tmp"C:\Users\Admin\AppData\Local\Temp\9433.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\94BF.tmp"C:\Users\Admin\AppData\Local\Temp\94BF.tmp"103⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\955C.tmp"C:\Users\Admin\AppData\Local\Temp\955C.tmp"104⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\95C9.tmp"C:\Users\Admin\AppData\Local\Temp\95C9.tmp"105⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\9636.tmp"C:\Users\Admin\AppData\Local\Temp\9636.tmp"106⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\96B3.tmp"C:\Users\Admin\AppData\Local\Temp\96B3.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\9730.tmp"C:\Users\Admin\AppData\Local\Temp\9730.tmp"108⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\97AD.tmp"C:\Users\Admin\AppData\Local\Temp\97AD.tmp"109⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\983A.tmp"C:\Users\Admin\AppData\Local\Temp\983A.tmp"110⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\98D6.tmp"C:\Users\Admin\AppData\Local\Temp\98D6.tmp"111⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\9963.tmp"C:\Users\Admin\AppData\Local\Temp\9963.tmp"112⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\99E0.tmp"C:\Users\Admin\AppData\Local\Temp\99E0.tmp"113⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\9A6C.tmp"C:\Users\Admin\AppData\Local\Temp\9A6C.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\9ADA.tmp"C:\Users\Admin\AppData\Local\Temp\9ADA.tmp"115⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\9B66.tmp"C:\Users\Admin\AppData\Local\Temp\9B66.tmp"116⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\9BD4.tmp"C:\Users\Admin\AppData\Local\Temp\9BD4.tmp"117⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\9C51.tmp"C:\Users\Admin\AppData\Local\Temp\9C51.tmp"118⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\9CBE.tmp"C:\Users\Admin\AppData\Local\Temp\9CBE.tmp"119⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\9D3B.tmp"C:\Users\Admin\AppData\Local\Temp\9D3B.tmp"120⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\9DD7.tmp"C:\Users\Admin\AppData\Local\Temp\9DD7.tmp"121⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\9E45.tmp"C:\Users\Admin\AppData\Local\Temp\9E45.tmp"122⤵PID:6004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-