Analysis
- max time kernel
127s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 06:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-15_f70ecb70f0c1e1f1c64d00072b840b50_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_f70ecb70f0c1e1f1c64d00072b840b50_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-07-15_f70ecb70f0c1e1f1c64d00072b840b50_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260715-gre1esfx91
- SHA256 41be35d62504c85df6aae13cdd7ba0b2327323e851bfb28cc1aeb50d8714e020
- MD5 f70ecb70f0c1e1f1c64d00072b840b50
- SHA1 b2d60c5a461a12bb21c2bafacc102147d37eac0b
- SHA512 d76f2cfc1ac4210f33978073a1bed0000551b4b7f5851e17b336d68a076cee6847df54cffc447d056c8d0646aaf88de1979f911097d1408e37e46502fd4af962
- SSDEEP 12288:NU5rCOTeijNoYL50fTXlpL8cYLcVdy82q8fmpTZwlH:NUQOJjNL907lpL0MdD8upTSlH
- TLSH T188B4F125B584C132E5D202714BE6EBA22E3B7C31572298C33B94676E6EB27E0D775307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4524 47A9.tmp 2864 4884.tmp 3384 4910.tmp 1876 49AD.tmp 3400 4A58.tmp 4808 4AE5.tmp 5656 4B91.tmp 2852 4C1E.tmp 5680 4CC9.tmp 2096 4D56.tmp 1864 4E12.tmp 1228 4F0C.tmp 5784 4FD7.tmp 4636 5083.tmp 4704 515D.tmp 3004 51DA.tmp 3464 5267.tmp 3276 5332.tmp 4904 53DE.tmp 3264 547A.tmp 4608 5536.tmp 1028 55E2.tmp 4588 563F.tmp 6040 56AD.tmp 2576 571A.tmp 4464 5787.tmp 3272 5804.tmp 800 5881.tmp 628 58DF.tmp 2392 593D.tmp 460 59AA.tmp 4204 5A37.tmp 2616 5AB4.tmp 3408 5B21.tmp 1936 5B7F.tmp 3452 5BDD.tmp 2268 5C5A.tmp 8 5CA8.tmp 4220 5D15.tmp 1296 5D73.tmp 5996 5DD1.tmp 6028 5E2F.tmp 3232 5E8C.tmp 3716 5EEA.tmp 4252 5F48.tmp 2736 5FA6.tmp 2968 6003.tmp 120 6071.tmp 2676 60FD.tmp 1512 618A.tmp 4168 61F7.tmp 2696 6274.tmp 1312 6311.tmp 3492 638E.tmp 3268 63EB.tmp 6064 6488.tmp 4364 6505.tmp 932 6572.tmp 5148 65DF.tmp 2464 665C.tmp 2188 66D9.tmp 4864 6756.tmp 2236 67C4.tmp 3860 6860.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8578.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8123.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 876C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F588.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7679.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A11E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A286.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4884.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4910.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F185.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E437.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 602D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A47A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B16A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D398.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 308D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2061.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9905.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A828.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2680.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 732E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C332.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F473.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C07E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 713A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A569.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1096 wrote to memory of 4524 1096 2026-07-15_f70ecb70f0c1e1f1c64d00072b840b50_elex_mafia_stealc_tofsee.exe 86 PID 4524 wrote to memory of 2864 4524 47A9.tmp 87 PID 2864 wrote to memory of 3384 2864 4884.tmp 88 PID 3384 wrote to memory of 1876 3384 4910.tmp 89 PID 1876 wrote to memory of 3400 1876 49AD.tmp 90 PID 3400 wrote to memory of 4808 3400 4A58.tmp 91 PID 4808 wrote to memory of 5656 4808 4AE5.tmp 92 PID 5656 wrote to memory of 2852 5656 4B91.tmp 93 PID 2852 wrote to memory of 5680 2852 4C1E.tmp 94 PID 5680 wrote to memory of 2096 5680 4CC9.tmp 95 PID 2096 wrote to memory of 1864 2096 4D56.tmp 96 PID 1864 wrote to memory of 1228 1864 4E12.tmp 97 PID 1228 wrote to memory of 5784 1228 4F0C.tmp 98 PID 5784 wrote to memory of 4636 5784 4FD7.tmp 99 PID 4636 wrote to memory of 4704 4636 5083.tmp 100 PID 4704 wrote to memory of 3004 4704 515D.tmp 101 PID 3004 wrote to memory of 3464 3004 51DA.tmp 102 PID 3464 wrote to memory of 3276 3464 5267.tmp 103 PID 3276 wrote to memory of 4904 3276 5332.tmp 104 PID 4904 wrote to memory of 3264 4904 53DE.tmp 105 PID 3264 wrote to memory of 4608 3264 547A.tmp 106 PID 4608 wrote to memory of 1028 4608 5536.tmp 107 PID 1028 wrote to memory of 4588 1028 55E2.tmp 108 PID 4588 wrote to memory of 6040 4588 563F.tmp 109 PID 6040 wrote to memory of 2576 6040 56AD.tmp 110 PID 2576 wrote to memory of 4464 2576 571A.tmp 111 PID 4464 wrote to memory of 3272 4464 5787.tmp 112 PID 3272 wrote to memory of 800 3272 5804.tmp 113 PID 800 wrote to memory of 628 800 5881.tmp 114 PID 628 wrote to memory of 2392 628 58DF.tmp 115 PID 2392 wrote to memory of 460 2392 593D.tmp 116 PID 460 wrote to memory of 4204 460 59AA.tmp 117 PID 4204 wrote to memory of 2616 4204 5A37.tmp 118 PID 2616 wrote to memory of 3408 2616 5AB4.tmp 119 PID 3408 wrote to memory of 1936 3408 5B21.tmp 120 PID 1936 wrote to memory of 3452 1936 5B7F.tmp 121 PID 3452 wrote to memory of 2268 3452 5BDD.tmp 122 PID 2268 wrote to memory of 8 2268 5C5A.tmp 123 PID 8 wrote to memory of 4220 8 5CA8.tmp 124 PID 4220 wrote to memory of 1296 4220 5D15.tmp 125 PID 1296 wrote to memory of 5996 1296 5D73.tmp 126 PID 5996 wrote to memory of 6028 5996 5DD1.tmp 127 PID 6028 wrote to memory of 3232 6028 5E2F.tmp 128 PID 3232 wrote to memory of 3716 3232 5E8C.tmp 129 PID 3716 wrote to memory of 4252 3716 5EEA.tmp 130 PID 4252 wrote to memory of 2736 4252 5F48.tmp 131 PID 2736 wrote to memory of 2968 2736 5FA6.tmp 132 PID 2968 wrote to memory of 120 2968 6003.tmp 133 PID 120 wrote to memory of 2676 120 6071.tmp 134 PID 2676 wrote to memory of 1512 2676 60FD.tmp 135 PID 1512 wrote to memory of 4168 1512 618A.tmp 136 PID 4168 wrote to memory of 2696 4168 61F7.tmp 137 PID 2696 wrote to memory of 1312 2696 6274.tmp 138 PID 1312 wrote to memory of 3492 1312 6311.tmp 139 PID 3492 wrote to memory of 3268 3492 638E.tmp 140 PID 3268 wrote to memory of 6064 3268 63EB.tmp 141 PID 6064 wrote to memory of 4364 6064 6488.tmp 142 PID 4364 wrote to memory of 932 4364 6505.tmp 143 PID 932 wrote to memory of 5148 932 6572.tmp 144 PID 5148 wrote to memory of 2464 5148 65DF.tmp 145 PID 2464 wrote to memory of 2188 2464 665C.tmp 146 PID 2188 wrote to memory of 4864 2188 66D9.tmp 147 PID 4864 wrote to memory of 2236 4864 6756.tmp 148 PID 2236 wrote to memory of 3860 2236 67C4.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_f70ecb70f0c1e1f1c64d00072b840b50_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_f70ecb70f0c1e1f1c64d00072b840b50_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\47A9.tmp"C:\Users\Admin\AppData\Local\Temp\47A9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\4884.tmp"C:\Users\Admin\AppData\Local\Temp\4884.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\4910.tmp"C:\Users\Admin\AppData\Local\Temp\4910.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\49AD.tmp"C:\Users\Admin\AppData\Local\Temp\49AD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\4A58.tmp"C:\Users\Admin\AppData\Local\Temp\4A58.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"C:\Users\Admin\AppData\Local\Temp\4AE5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\4B91.tmp"C:\Users\Admin\AppData\Local\Temp\4B91.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\4C1E.tmp"C:\Users\Admin\AppData\Local\Temp\4C1E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\4D56.tmp"C:\Users\Admin\AppData\Local\Temp\4D56.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\4E12.tmp"C:\Users\Admin\AppData\Local\Temp\4E12.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\4F0C.tmp"C:\Users\Admin\AppData\Local\Temp\4F0C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\4FD7.tmp"C:\Users\Admin\AppData\Local\Temp\4FD7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\5083.tmp"C:\Users\Admin\AppData\Local\Temp\5083.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\515D.tmp"C:\Users\Admin\AppData\Local\Temp\515D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\51DA.tmp"C:\Users\Admin\AppData\Local\Temp\51DA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\5267.tmp"C:\Users\Admin\AppData\Local\Temp\5267.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\5332.tmp"C:\Users\Admin\AppData\Local\Temp\5332.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\53DE.tmp"C:\Users\Admin\AppData\Local\Temp\53DE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\547A.tmp"C:\Users\Admin\AppData\Local\Temp\547A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\5536.tmp"C:\Users\Admin\AppData\Local\Temp\5536.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\55E2.tmp"C:\Users\Admin\AppData\Local\Temp\55E2.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\563F.tmp"C:\Users\Admin\AppData\Local\Temp\563F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\56AD.tmp"C:\Users\Admin\AppData\Local\Temp\56AD.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\571A.tmp"C:\Users\Admin\AppData\Local\Temp\571A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\5787.tmp"C:\Users\Admin\AppData\Local\Temp\5787.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\5804.tmp"C:\Users\Admin\AppData\Local\Temp\5804.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\5881.tmp"C:\Users\Admin\AppData\Local\Temp\5881.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\58DF.tmp"C:\Users\Admin\AppData\Local\Temp\58DF.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\593D.tmp"C:\Users\Admin\AppData\Local\Temp\593D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\59AA.tmp"C:\Users\Admin\AppData\Local\Temp\59AA.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\5A37.tmp"C:\Users\Admin\AppData\Local\Temp\5A37.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\5AB4.tmp"C:\Users\Admin\AppData\Local\Temp\5AB4.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\5B21.tmp"C:\Users\Admin\AppData\Local\Temp\5B21.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\5B7F.tmp"C:\Users\Admin\AppData\Local\Temp\5B7F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\5BDD.tmp"C:\Users\Admin\AppData\Local\Temp\5BDD.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\5C5A.tmp"C:\Users\Admin\AppData\Local\Temp\5C5A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\5CA8.tmp"C:\Users\Admin\AppData\Local\Temp\5CA8.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\5D15.tmp"C:\Users\Admin\AppData\Local\Temp\5D15.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\5D73.tmp"C:\Users\Admin\AppData\Local\Temp\5D73.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\5DD1.tmp"C:\Users\Admin\AppData\Local\Temp\5DD1.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\5E2F.tmp"C:\Users\Admin\AppData\Local\Temp\5E2F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\5E8C.tmp"C:\Users\Admin\AppData\Local\Temp\5E8C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\5EEA.tmp"C:\Users\Admin\AppData\Local\Temp\5EEA.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\5F48.tmp"C:\Users\Admin\AppData\Local\Temp\5F48.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\5FA6.tmp"C:\Users\Admin\AppData\Local\Temp\5FA6.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\6003.tmp"C:\Users\Admin\AppData\Local\Temp\6003.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\6071.tmp"C:\Users\Admin\AppData\Local\Temp\6071.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Users\Admin\AppData\Local\Temp\60FD.tmp"C:\Users\Admin\AppData\Local\Temp\60FD.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\618A.tmp"C:\Users\Admin\AppData\Local\Temp\618A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\61F7.tmp"C:\Users\Admin\AppData\Local\Temp\61F7.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\6274.tmp"C:\Users\Admin\AppData\Local\Temp\6274.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\6311.tmp"C:\Users\Admin\AppData\Local\Temp\6311.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\638E.tmp"C:\Users\Admin\AppData\Local\Temp\638E.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\63EB.tmp"C:\Users\Admin\AppData\Local\Temp\63EB.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\6488.tmp"C:\Users\Admin\AppData\Local\Temp\6488.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\6505.tmp"C:\Users\Admin\AppData\Local\Temp\6505.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\6572.tmp"C:\Users\Admin\AppData\Local\Temp\6572.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\65DF.tmp"C:\Users\Admin\AppData\Local\Temp\65DF.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\665C.tmp"C:\Users\Admin\AppData\Local\Temp\665C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\66D9.tmp"C:\Users\Admin\AppData\Local\Temp\66D9.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\6756.tmp"C:\Users\Admin\AppData\Local\Temp\6756.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\67C4.tmp"C:\Users\Admin\AppData\Local\Temp\67C4.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\6860.tmp"C:\Users\Admin\AppData\Local\Temp\6860.tmp"65⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\68CD.tmp"C:\Users\Admin\AppData\Local\Temp\68CD.tmp"66⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\694A.tmp"C:\Users\Admin\AppData\Local\Temp\694A.tmp"67⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\69E7.tmp"C:\Users\Admin\AppData\Local\Temp\69E7.tmp"68⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\6A64.tmp"C:\Users\Admin\AppData\Local\Temp\6A64.tmp"69⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\6AE1.tmp"C:\Users\Admin\AppData\Local\Temp\6AE1.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\6B3E.tmp"C:\Users\Admin\AppData\Local\Temp\6B3E.tmp"71⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\6BBB.tmp"C:\Users\Admin\AppData\Local\Temp\6BBB.tmp"72⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\6C48.tmp"C:\Users\Admin\AppData\Local\Temp\6C48.tmp"73⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\6CC5.tmp"C:\Users\Admin\AppData\Local\Temp\6CC5.tmp"74⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\6D23.tmp"C:\Users\Admin\AppData\Local\Temp\6D23.tmp"75⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\6DA0.tmp"C:\Users\Admin\AppData\Local\Temp\6DA0.tmp"76⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\6E2C.tmp"C:\Users\Admin\AppData\Local\Temp\6E2C.tmp"77⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\6EB9.tmp"C:\Users\Admin\AppData\Local\Temp\6EB9.tmp"78⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\6F46.tmp"C:\Users\Admin\AppData\Local\Temp\6F46.tmp"79⤵PID:248
-
C:\Users\Admin\AppData\Local\Temp\6FB3.tmp"C:\Users\Admin\AppData\Local\Temp\6FB3.tmp"80⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\7030.tmp"C:\Users\Admin\AppData\Local\Temp\7030.tmp"81⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\70AD.tmp"C:\Users\Admin\AppData\Local\Temp\70AD.tmp"82⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\713A.tmp"C:\Users\Admin\AppData\Local\Temp\713A.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"84⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\7234.tmp"C:\Users\Admin\AppData\Local\Temp\7234.tmp"85⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\72B1.tmp"C:\Users\Admin\AppData\Local\Temp\72B1.tmp"86⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\732E.tmp"C:\Users\Admin\AppData\Local\Temp\732E.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\73BA.tmp"C:\Users\Admin\AppData\Local\Temp\73BA.tmp"88⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\7447.tmp"C:\Users\Admin\AppData\Local\Temp\7447.tmp"89⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\74C4.tmp"C:\Users\Admin\AppData\Local\Temp\74C4.tmp"90⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\7560.tmp"C:\Users\Admin\AppData\Local\Temp\7560.tmp"91⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\75ED.tmp"C:\Users\Admin\AppData\Local\Temp\75ED.tmp"92⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\7679.tmp"C:\Users\Admin\AppData\Local\Temp\7679.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\7716.tmp"C:\Users\Admin\AppData\Local\Temp\7716.tmp"94⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\77A2.tmp"C:\Users\Admin\AppData\Local\Temp\77A2.tmp"95⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\782F.tmp"C:\Users\Admin\AppData\Local\Temp\782F.tmp"96⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\78BB.tmp"C:\Users\Admin\AppData\Local\Temp\78BB.tmp"97⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\7938.tmp"C:\Users\Admin\AppData\Local\Temp\7938.tmp"98⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\79B5.tmp"C:\Users\Admin\AppData\Local\Temp\79B5.tmp"99⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\7A32.tmp"C:\Users\Admin\AppData\Local\Temp\7A32.tmp"100⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\7AA0.tmp"C:\Users\Admin\AppData\Local\Temp\7AA0.tmp"101⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\7B0D.tmp"C:\Users\Admin\AppData\Local\Temp\7B0D.tmp"102⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\7B9A.tmp"C:\Users\Admin\AppData\Local\Temp\7B9A.tmp"103⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\7BF8.tmp"C:\Users\Admin\AppData\Local\Temp\7BF8.tmp"104⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\7C94.tmp"C:\Users\Admin\AppData\Local\Temp\7C94.tmp"105⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\7D20.tmp"C:\Users\Admin\AppData\Local\Temp\7D20.tmp"106⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\7DCC.tmp"C:\Users\Admin\AppData\Local\Temp\7DCC.tmp"107⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\7E59.tmp"C:\Users\Admin\AppData\Local\Temp\7E59.tmp"108⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\7EE6.tmp"C:\Users\Admin\AppData\Local\Temp\7EE6.tmp"109⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\7F82.tmp"C:\Users\Admin\AppData\Local\Temp\7F82.tmp"110⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\800E.tmp"C:\Users\Admin\AppData\Local\Temp\800E.tmp"111⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\807C.tmp"C:\Users\Admin\AppData\Local\Temp\807C.tmp"112⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\8108.tmp"C:\Users\Admin\AppData\Local\Temp\8108.tmp"113⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\8185.tmp"C:\Users\Admin\AppData\Local\Temp\8185.tmp"114⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\8202.tmp"C:\Users\Admin\AppData\Local\Temp\8202.tmp"115⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\828F.tmp"C:\Users\Admin\AppData\Local\Temp\828F.tmp"116⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\830C.tmp"C:\Users\Admin\AppData\Local\Temp\830C.tmp"117⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\83A8.tmp"C:\Users\Admin\AppData\Local\Temp\83A8.tmp"118⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\8435.tmp"C:\Users\Admin\AppData\Local\Temp\8435.tmp"119⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\84B2.tmp"C:\Users\Admin\AppData\Local\Temp\84B2.tmp"120⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\855E.tmp"C:\Users\Admin\AppData\Local\Temp\855E.tmp"121⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\85FA.tmp"C:\Users\Admin\AppData\Local\Temp\85FA.tmp"122⤵PID:4968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-