Analysis
- max time kernel
131s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 05:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_e240d79bcb2ff7b736d9c55748d9a498_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_e240d79bcb2ff7b736d9c55748d9a498_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-07-14_e240d79bcb2ff7b736d9c55748d9a498_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260714-glgbasez7l
- SHA256 8cd8cf5e62f736782d93d92f4f49ce14e5e8eed033fc82fc61d74763e546914e
- MD5 e240d79bcb2ff7b736d9c55748d9a498
- SHA1 96643e4548974f186e4b7eec3ea41b6238f09002
- SHA512 ad7d88b6455d794515f142dc8c5f762555e6eb182c5a120220ecad4d7a3487a7084e6eb8fd8272b33a7901251ee4f097f65df512533baa8e2f00919b9c3b460d
- SSDEEP 12288:NU5rCOTeij93g9W7CMc2eECD1cjc0TZwlH4Hp:NUQOJjZoaCM2D1F0TSlH4Hp
- TLSH T158B4F126B681C172D68202710BD6EBA26A3E7C35A72660C33B94627D2FB57E1D375307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4384 6F6A.tmp 1408 7006.tmp 4164 715E.tmp 2632 7313.tmp 4140 73EE.tmp 3376 748A.tmp 4620 7555.tmp 5872 7620.tmp 4400 772A.tmp 3124 77F5.tmp 4156 78DF.tmp 4604 797C.tmp 4432 7A37.tmp 4348 7B31.tmp 5664 7C0C.tmp 2116 7CE7.tmp 2868 7D73.tmp 3408 7E2F.tmp 4564 7EEA.tmp 2776 7FC5.tmp 2168 8081.tmp 4892 814C.tmp 2208 8207.tmp 3640 82C3.tmp 2364 83AD.tmp 1040 8459.tmp 1352 8514.tmp 2708 85C0.tmp 1424 863D.tmp 4880 86F9.tmp 2872 87A5.tmp 1916 8851.tmp 472 892B.tmp 2808 89B8.tmp 984 8A54.tmp 5136 8AF0.tmp 468 8B5E.tmp 5944 8BEA.tmp 3424 8C67.tmp 5380 8CE4.tmp 2244 8D61.tmp 5876 8DFE.tmp 2532 8E7B.tmp 564 8F07.tmp 4212 8FA4.tmp 4884 9030.tmp 3420 90BD.tmp 5740 913A.tmp 2104 91B7.tmp 6028 9263.tmp 3664 92EF.tmp 4804 936C.tmp 4296 93E9.tmp 1036 9476.tmp 5012 94F3.tmp 2948 9580.tmp 2248 960C.tmp 3524 9689.tmp 2752 9706.tmp 4456 97A2.tmp 2684 983F.tmp 2512 98BC.tmp 5640 9948.tmp 5056 99C5.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F87F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 158D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 954C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 943.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 246D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 583E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E10F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F708.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1128.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 370A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 491B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 983F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 687F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 806C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 979E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B31A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1696.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6648.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 863D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1399.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A59D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F67C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 983A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C228.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9948.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E47.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4680 wrote to memory of 4384 4680 2026-07-14_e240d79bcb2ff7b736d9c55748d9a498_elex_mafia_stealc_tofsee.exe 87 PID 4384 wrote to memory of 1408 4384 6F6A.tmp 88 PID 1408 wrote to memory of 4164 1408 7006.tmp 89 PID 4164 wrote to memory of 2632 4164 715E.tmp 90 PID 2632 wrote to memory of 4140 2632 7313.tmp 91 PID 4140 wrote to memory of 3376 4140 73EE.tmp 92 PID 3376 wrote to memory of 4620 3376 748A.tmp 93 PID 4620 wrote to memory of 5872 4620 7555.tmp 94 PID 5872 wrote to memory of 4400 5872 7620.tmp 95 PID 4400 wrote to memory of 3124 4400 772A.tmp 96 PID 3124 wrote to memory of 4156 3124 77F5.tmp 97 PID 4156 wrote to memory of 4604 4156 78DF.tmp 98 PID 4604 wrote to memory of 4432 4604 797C.tmp 99 PID 4432 wrote to memory of 4348 4432 7A37.tmp 100 PID 4348 wrote to memory of 5664 4348 7B31.tmp 101 PID 5664 wrote to memory of 2116 5664 7C0C.tmp 102 PID 2116 wrote to memory of 2868 2116 7CE7.tmp 103 PID 2868 wrote to memory of 3408 2868 7D73.tmp 104 PID 3408 wrote to memory of 4564 3408 7E2F.tmp 105 PID 4564 wrote to memory of 2776 4564 7EEA.tmp 106 PID 2776 wrote to memory of 2168 2776 7FC5.tmp 107 PID 2168 wrote to memory of 4892 2168 8081.tmp 108 PID 4892 wrote to memory of 2208 4892 814C.tmp 109 PID 2208 wrote to memory of 3640 2208 8207.tmp 110 PID 3640 wrote to memory of 2364 3640 82C3.tmp 111 PID 2364 wrote to memory of 1040 2364 83AD.tmp 112 PID 1040 wrote to memory of 1352 1040 8459.tmp 113 PID 1352 wrote to memory of 2708 1352 8514.tmp 114 PID 2708 wrote to memory of 1424 2708 85C0.tmp 115 PID 1424 wrote to memory of 4880 1424 863D.tmp 116 PID 4880 wrote to memory of 2872 4880 86F9.tmp 117 PID 2872 wrote to memory of 1916 2872 87A5.tmp 118 PID 1916 wrote to memory of 472 1916 8851.tmp 119 PID 472 wrote to memory of 2808 472 892B.tmp 120 PID 2808 wrote to memory of 984 2808 89B8.tmp 121 PID 984 wrote to memory of 5136 984 8A54.tmp 122 PID 5136 wrote to memory of 468 5136 8AF0.tmp 123 PID 468 wrote to memory of 5944 468 8B5E.tmp 124 PID 5944 wrote to memory of 3424 5944 8BEA.tmp 125 PID 3424 wrote to memory of 5380 3424 8C67.tmp 126 PID 5380 wrote to memory of 2244 5380 8CE4.tmp 127 PID 2244 wrote to memory of 5876 2244 8D61.tmp 128 PID 5876 wrote to memory of 2532 5876 8DFE.tmp 129 PID 2532 wrote to memory of 564 2532 8E7B.tmp 130 PID 564 wrote to memory of 4212 564 8F07.tmp 131 PID 4212 wrote to memory of 4884 4212 8FA4.tmp 132 PID 4884 wrote to memory of 3420 4884 9030.tmp 133 PID 3420 wrote to memory of 5740 3420 90BD.tmp 134 PID 5740 wrote to memory of 2104 5740 913A.tmp 135 PID 2104 wrote to memory of 6028 2104 91B7.tmp 136 PID 6028 wrote to memory of 3664 6028 9263.tmp 137 PID 3664 wrote to memory of 4804 3664 92EF.tmp 138 PID 4804 wrote to memory of 4296 4804 936C.tmp 139 PID 4296 wrote to memory of 1036 4296 93E9.tmp 140 PID 1036 wrote to memory of 5012 1036 9476.tmp 141 PID 5012 wrote to memory of 2948 5012 94F3.tmp 142 PID 2948 wrote to memory of 2248 2948 9580.tmp 143 PID 2248 wrote to memory of 3524 2248 960C.tmp 144 PID 3524 wrote to memory of 2752 3524 9689.tmp 145 PID 2752 wrote to memory of 4456 2752 9706.tmp 146 PID 4456 wrote to memory of 2684 4456 97A2.tmp 147 PID 2684 wrote to memory of 2512 2684 983F.tmp 148 PID 2512 wrote to memory of 5640 2512 98BC.tmp 149 PID 5640 wrote to memory of 5056 5640 9948.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_e240d79bcb2ff7b736d9c55748d9a498_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_e240d79bcb2ff7b736d9c55748d9a498_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\6F6A.tmp"C:\Users\Admin\AppData\Local\Temp\6F6A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\7006.tmp"C:\Users\Admin\AppData\Local\Temp\7006.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\715E.tmp"C:\Users\Admin\AppData\Local\Temp\715E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\7313.tmp"C:\Users\Admin\AppData\Local\Temp\7313.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\73EE.tmp"C:\Users\Admin\AppData\Local\Temp\73EE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\748A.tmp"C:\Users\Admin\AppData\Local\Temp\748A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\7555.tmp"C:\Users\Admin\AppData\Local\Temp\7555.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\7620.tmp"C:\Users\Admin\AppData\Local\Temp\7620.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\772A.tmp"C:\Users\Admin\AppData\Local\Temp\772A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\77F5.tmp"C:\Users\Admin\AppData\Local\Temp\77F5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\78DF.tmp"C:\Users\Admin\AppData\Local\Temp\78DF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\797C.tmp"C:\Users\Admin\AppData\Local\Temp\797C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\7A37.tmp"C:\Users\Admin\AppData\Local\Temp\7A37.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\7B31.tmp"C:\Users\Admin\AppData\Local\Temp\7B31.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\7CE7.tmp"C:\Users\Admin\AppData\Local\Temp\7CE7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\7D73.tmp"C:\Users\Admin\AppData\Local\Temp\7D73.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\7EEA.tmp"C:\Users\Admin\AppData\Local\Temp\7EEA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\7FC5.tmp"C:\Users\Admin\AppData\Local\Temp\7FC5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\8081.tmp"C:\Users\Admin\AppData\Local\Temp\8081.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\814C.tmp"C:\Users\Admin\AppData\Local\Temp\814C.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\8207.tmp"C:\Users\Admin\AppData\Local\Temp\8207.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\82C3.tmp"C:\Users\Admin\AppData\Local\Temp\82C3.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\83AD.tmp"C:\Users\Admin\AppData\Local\Temp\83AD.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\8459.tmp"C:\Users\Admin\AppData\Local\Temp\8459.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\8514.tmp"C:\Users\Admin\AppData\Local\Temp\8514.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\85C0.tmp"C:\Users\Admin\AppData\Local\Temp\85C0.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\863D.tmp"C:\Users\Admin\AppData\Local\Temp\863D.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\86F9.tmp"C:\Users\Admin\AppData\Local\Temp\86F9.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\87A5.tmp"C:\Users\Admin\AppData\Local\Temp\87A5.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\8851.tmp"C:\Users\Admin\AppData\Local\Temp\8851.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\892B.tmp"C:\Users\Admin\AppData\Local\Temp\892B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\89B8.tmp"C:\Users\Admin\AppData\Local\Temp\89B8.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\8A54.tmp"C:\Users\Admin\AppData\Local\Temp\8A54.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\8BEA.tmp"C:\Users\Admin\AppData\Local\Temp\8BEA.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\8C67.tmp"C:\Users\Admin\AppData\Local\Temp\8C67.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\8DFE.tmp"C:\Users\Admin\AppData\Local\Temp\8DFE.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\8F07.tmp"C:\Users\Admin\AppData\Local\Temp\8F07.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\8FA4.tmp"C:\Users\Admin\AppData\Local\Temp\8FA4.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\9030.tmp"C:\Users\Admin\AppData\Local\Temp\9030.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\90BD.tmp"C:\Users\Admin\AppData\Local\Temp\90BD.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\913A.tmp"C:\Users\Admin\AppData\Local\Temp\913A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\91B7.tmp"C:\Users\Admin\AppData\Local\Temp\91B7.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\9263.tmp"C:\Users\Admin\AppData\Local\Temp\9263.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\92EF.tmp"C:\Users\Admin\AppData\Local\Temp\92EF.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\936C.tmp"C:\Users\Admin\AppData\Local\Temp\936C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\93E9.tmp"C:\Users\Admin\AppData\Local\Temp\93E9.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\9476.tmp"C:\Users\Admin\AppData\Local\Temp\9476.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\94F3.tmp"C:\Users\Admin\AppData\Local\Temp\94F3.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\9580.tmp"C:\Users\Admin\AppData\Local\Temp\9580.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\960C.tmp"C:\Users\Admin\AppData\Local\Temp\960C.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\9689.tmp"C:\Users\Admin\AppData\Local\Temp\9689.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\9706.tmp"C:\Users\Admin\AppData\Local\Temp\9706.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\97A2.tmp"C:\Users\Admin\AppData\Local\Temp\97A2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\983F.tmp"C:\Users\Admin\AppData\Local\Temp\983F.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\98BC.tmp"C:\Users\Admin\AppData\Local\Temp\98BC.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\9948.tmp"C:\Users\Admin\AppData\Local\Temp\9948.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\99C5.tmp"C:\Users\Admin\AppData\Local\Temp\99C5.tmp"65⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\9A42.tmp"C:\Users\Admin\AppData\Local\Temp\9A42.tmp"66⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"67⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"69⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\9C65.tmp"C:\Users\Admin\AppData\Local\Temp\9C65.tmp"70⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\9CF2.tmp"C:\Users\Admin\AppData\Local\Temp\9CF2.tmp"71⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"72⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\9E1B.tmp"C:\Users\Admin\AppData\Local\Temp\9E1B.tmp"73⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\9E98.tmp"C:\Users\Admin\AppData\Local\Temp\9E98.tmp"74⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\9F24.tmp"C:\Users\Admin\AppData\Local\Temp\9F24.tmp"75⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\9F92.tmp"C:\Users\Admin\AppData\Local\Temp\9F92.tmp"76⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\9FFF.tmp"C:\Users\Admin\AppData\Local\Temp\9FFF.tmp"77⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\A0AB.tmp"C:\Users\Admin\AppData\Local\Temp\A0AB.tmp"78⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\A147.tmp"C:\Users\Admin\AppData\Local\Temp\A147.tmp"79⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\A1D4.tmp"C:\Users\Admin\AppData\Local\Temp\A1D4.tmp"80⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\A251.tmp"C:\Users\Admin\AppData\Local\Temp\A251.tmp"81⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\A2CE.tmp"C:\Users\Admin\AppData\Local\Temp\A2CE.tmp"82⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\A34B.tmp"C:\Users\Admin\AppData\Local\Temp\A34B.tmp"83⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\A3C8.tmp"C:\Users\Admin\AppData\Local\Temp\A3C8.tmp"84⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\A454.tmp"C:\Users\Admin\AppData\Local\Temp\A454.tmp"85⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\A510.tmp"C:\Users\Admin\AppData\Local\Temp\A510.tmp"86⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\A59D.tmp"C:\Users\Admin\AppData\Local\Temp\A59D.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\A639.tmp"C:\Users\Admin\AppData\Local\Temp\A639.tmp"88⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\A6C5.tmp"C:\Users\Admin\AppData\Local\Temp\A6C5.tmp"89⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\A7CF.tmp"C:\Users\Admin\AppData\Local\Temp\A7CF.tmp"90⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\A85C.tmp"C:\Users\Admin\AppData\Local\Temp\A85C.tmp"91⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"C:\Users\Admin\AppData\Local\Temp\A8E8.tmp"92⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\A985.tmp"C:\Users\Admin\AppData\Local\Temp\A985.tmp"93⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\A9F2.tmp"C:\Users\Admin\AppData\Local\Temp\A9F2.tmp"94⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\AA5F.tmp"C:\Users\Admin\AppData\Local\Temp\AA5F.tmp"95⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\AAFC.tmp"C:\Users\Admin\AppData\Local\Temp\AAFC.tmp"96⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\AB79.tmp"C:\Users\Admin\AppData\Local\Temp\AB79.tmp"97⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\AC05.tmp"C:\Users\Admin\AppData\Local\Temp\AC05.tmp"98⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\AC73.tmp"C:\Users\Admin\AppData\Local\Temp\AC73.tmp"99⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\ACE0.tmp"C:\Users\Admin\AppData\Local\Temp\ACE0.tmp"100⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"101⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\ADF9.tmp"C:\Users\Admin\AppData\Local\Temp\ADF9.tmp"102⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\AE76.tmp"C:\Users\Admin\AppData\Local\Temp\AE76.tmp"103⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\AF03.tmp"C:\Users\Admin\AppData\Local\Temp\AF03.tmp"104⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\AFAF.tmp"C:\Users\Admin\AppData\Local\Temp\AFAF.tmp"105⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\B03B.tmp"C:\Users\Admin\AppData\Local\Temp\B03B.tmp"106⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\B0C8.tmp"C:\Users\Admin\AppData\Local\Temp\B0C8.tmp"107⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\B155.tmp"C:\Users\Admin\AppData\Local\Temp\B155.tmp"108⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"110⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\B31A.tmp"C:\Users\Admin\AppData\Local\Temp\B31A.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"C:\Users\Admin\AppData\Local\Temp\B3B6.tmp"112⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\B452.tmp"C:\Users\Admin\AppData\Local\Temp\B452.tmp"113⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\B4EE.tmp"C:\Users\Admin\AppData\Local\Temp\B4EE.tmp"114⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\B59A.tmp"C:\Users\Admin\AppData\Local\Temp\B59A.tmp"115⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\B656.tmp"C:\Users\Admin\AppData\Local\Temp\B656.tmp"116⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\B711.tmp"C:\Users\Admin\AppData\Local\Temp\B711.tmp"117⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"118⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\B81B.tmp"C:\Users\Admin\AppData\Local\Temp\B81B.tmp"119⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\B8C7.tmp"C:\Users\Admin\AppData\Local\Temp\B8C7.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\B953.tmp"C:\Users\Admin\AppData\Local\Temp\B953.tmp"121⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"122⤵PID:4168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-