Analysis
- max time kernel
130s - max time network
119s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 01:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_058ee283e76f6b3e442953fd9bf3ea25_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_058ee283e76f6b3e442953fd9bf3ea25_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-07-17_058ee283e76f6b3e442953fd9bf3ea25_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260717-b6579shv2n
- SHA256 fdaeae1aaac22e1e6d9d5617c66c3f6ce0a50cd90bc01d8d7a6dc2d4f5f99cbf
- MD5 058ee283e76f6b3e442953fd9bf3ea25
- SHA1 3126252e6ce83070ee7087e9f64559b3d061f59d
- SHA512 29ae4deaeacfcac0454c1568978a4baf368c79ec2ea85fdb7752922ce704666a6f20ab7592870c12933f6bd776e597a853f58b051e33ce3b37f40b71a4319a04
- SSDEEP 12288:wU5rCOTeiD2Wfyz8Vz/xjQCrZQp1DNZ+3/v+I9hUG2VA:wUQOJD2WfyQPxNQvNGEA
- TLSH T17EE4D02173D8C632E5FB037859B5E6514E7EBD36AB22D6CF2B8015AE0971BC09631723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5552 4807.tmp 1184 48F1.tmp 248 495E.tmp 3400 4B43.tmp 1804 4C7B.tmp 3396 4D27.tmp 4004 4D95.tmp 2296 4E7F.tmp 1864 4EFC.tmp 1268 512E.tmp 4232 5277.tmp 3344 53AF.tmp 4680 54C8.tmp 4176 55B3.tmp 3360 569D.tmp 1676 57E5.tmp 4608 590E.tmp 1624 5A18.tmp 1352 5B31.tmp 6020 5C98.tmp 4856 5DF0.tmp 2108 5EFA.tmp 4744 5FF4.tmp 3700 60CE.tmp 5072 6245.tmp 6036 637E.tmp 2288 64D6.tmp 5140 665C.tmp 3568 6776.tmp 4740 689E.tmp 4876 69C7.tmp 5248 6AD1.tmp 3232 6BBB.tmp 688 6C58.tmp 1872 6D13.tmp 1684 6DA0.tmp 3280 6EA9.tmp 2808 6F65.tmp 4284 7030.tmp 4900 70BD.tmp 2420 7178.tmp 1396 7224.tmp 2908 72DF.tmp 3460 73BA.tmp 932 7466.tmp 2380 7541.tmp 3212 760C.tmp 5000 76F6.tmp 6124 77D1.tmp 252 786D.tmp 1232 78DB.tmp 5476 7967.tmp 4208 79E4.tmp 4572 7A81.tmp 4280 7B1D.tmp 3800 7B8A.tmp 4916 7C75.tmp 1868 7CF2.tmp 2800 7D7E.tmp 5460 7E1A.tmp 4808 7EB7.tmp 4408 7F53.tmp 4008 7FD0.tmp 4016 806C.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F430.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4543.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F663.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3214.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6245.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8222.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 921F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B49C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 558F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7200.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 944D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C63A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8936.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A47A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F077.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F895.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E030.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 536C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E986.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8185.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3787.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 847E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C768.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 683C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 877C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E8E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1384 wrote to memory of 5552 1384 2026-07-17_058ee283e76f6b3e442953fd9bf3ea25_elex_mafia_stealc_tofsee.exe 86 PID 5552 wrote to memory of 1184 5552 4807.tmp 87 PID 1184 wrote to memory of 248 1184 48F1.tmp 88 PID 248 wrote to memory of 3400 248 495E.tmp 89 PID 3400 wrote to memory of 1804 3400 4B43.tmp 90 PID 1804 wrote to memory of 3396 1804 4C7B.tmp 91 PID 3396 wrote to memory of 4004 3396 4D27.tmp 92 PID 4004 wrote to memory of 2296 4004 4D95.tmp 93 PID 2296 wrote to memory of 1864 2296 4E7F.tmp 94 PID 1864 wrote to memory of 1268 1864 4EFC.tmp 95 PID 1268 wrote to memory of 4232 1268 512E.tmp 96 PID 4232 wrote to memory of 3344 4232 5277.tmp 97 PID 3344 wrote to memory of 4680 3344 53AF.tmp 98 PID 4680 wrote to memory of 4176 4680 54C8.tmp 99 PID 4176 wrote to memory of 3360 4176 55B3.tmp 100 PID 3360 wrote to memory of 1676 3360 569D.tmp 101 PID 1676 wrote to memory of 4608 1676 57E5.tmp 102 PID 4608 wrote to memory of 1624 4608 590E.tmp 103 PID 1624 wrote to memory of 1352 1624 5A18.tmp 104 PID 1352 wrote to memory of 6020 1352 5B31.tmp 105 PID 6020 wrote to memory of 4856 6020 5C98.tmp 106 PID 4856 wrote to memory of 2108 4856 5DF0.tmp 107 PID 2108 wrote to memory of 4744 2108 5EFA.tmp 108 PID 4744 wrote to memory of 3700 4744 5FF4.tmp 109 PID 3700 wrote to memory of 5072 3700 60CE.tmp 110 PID 5072 wrote to memory of 6036 5072 6245.tmp 111 PID 6036 wrote to memory of 2288 6036 637E.tmp 112 PID 2288 wrote to memory of 5140 2288 64D6.tmp 113 PID 5140 wrote to memory of 3568 5140 665C.tmp 114 PID 3568 wrote to memory of 4740 3568 6776.tmp 115 PID 4740 wrote to memory of 4876 4740 689E.tmp 116 PID 4876 wrote to memory of 5248 4876 69C7.tmp 117 PID 5248 wrote to memory of 3232 5248 6AD1.tmp 118 PID 3232 wrote to memory of 688 3232 6BBB.tmp 119 PID 688 wrote to memory of 1872 688 6C58.tmp 120 PID 1872 wrote to memory of 1684 1872 6D13.tmp 121 PID 1684 wrote to memory of 3280 1684 6DA0.tmp 122 PID 3280 wrote to memory of 2808 3280 6EA9.tmp 123 PID 2808 wrote to memory of 4284 2808 6F65.tmp 124 PID 4284 wrote to memory of 4900 4284 7030.tmp 125 PID 4900 wrote to memory of 2420 4900 70BD.tmp 126 PID 2420 wrote to memory of 1396 2420 7178.tmp 127 PID 1396 wrote to memory of 2908 1396 7224.tmp 128 PID 2908 wrote to memory of 3460 2908 72DF.tmp 129 PID 3460 wrote to memory of 932 3460 73BA.tmp 130 PID 932 wrote to memory of 2380 932 7466.tmp 131 PID 2380 wrote to memory of 3212 2380 7541.tmp 132 PID 3212 wrote to memory of 5000 3212 760C.tmp 133 PID 5000 wrote to memory of 6124 5000 76F6.tmp 134 PID 6124 wrote to memory of 252 6124 77D1.tmp 135 PID 252 wrote to memory of 1232 252 786D.tmp 136 PID 1232 wrote to memory of 5476 1232 78DB.tmp 137 PID 5476 wrote to memory of 4208 5476 7967.tmp 138 PID 4208 wrote to memory of 4572 4208 79E4.tmp 139 PID 4572 wrote to memory of 4280 4572 7A81.tmp 140 PID 4280 wrote to memory of 3800 4280 7B1D.tmp 141 PID 5284 wrote to memory of 4916 5284 7C07.tmp 143 PID 4916 wrote to memory of 1868 4916 7C75.tmp 144 PID 1868 wrote to memory of 2800 1868 7CF2.tmp 145 PID 2800 wrote to memory of 5460 2800 7D7E.tmp 146 PID 5460 wrote to memory of 4808 5460 7E1A.tmp 147 PID 4808 wrote to memory of 4408 4808 7EB7.tmp 148 PID 4408 wrote to memory of 4008 4408 7F53.tmp 149 PID 4008 wrote to memory of 4016 4008 7FD0.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_058ee283e76f6b3e442953fd9bf3ea25_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_058ee283e76f6b3e442953fd9bf3ea25_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\4807.tmp"C:\Users\Admin\AppData\Local\Temp\4807.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\48F1.tmp"C:\Users\Admin\AppData\Local\Temp\48F1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\495E.tmp"C:\Users\Admin\AppData\Local\Temp\495E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\4B43.tmp"C:\Users\Admin\AppData\Local\Temp\4B43.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"C:\Users\Admin\AppData\Local\Temp\4C7B.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\4D27.tmp"C:\Users\Admin\AppData\Local\Temp\4D27.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\4D95.tmp"C:\Users\Admin\AppData\Local\Temp\4D95.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\4E7F.tmp"C:\Users\Admin\AppData\Local\Temp\4E7F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\4EFC.tmp"C:\Users\Admin\AppData\Local\Temp\4EFC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\512E.tmp"C:\Users\Admin\AppData\Local\Temp\512E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\5277.tmp"C:\Users\Admin\AppData\Local\Temp\5277.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\53AF.tmp"C:\Users\Admin\AppData\Local\Temp\53AF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\54C8.tmp"C:\Users\Admin\AppData\Local\Temp\54C8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\55B3.tmp"C:\Users\Admin\AppData\Local\Temp\55B3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\569D.tmp"C:\Users\Admin\AppData\Local\Temp\569D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\57E5.tmp"C:\Users\Admin\AppData\Local\Temp\57E5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\590E.tmp"C:\Users\Admin\AppData\Local\Temp\590E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\5A18.tmp"C:\Users\Admin\AppData\Local\Temp\5A18.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\5B31.tmp"C:\Users\Admin\AppData\Local\Temp\5B31.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\5C98.tmp"C:\Users\Admin\AppData\Local\Temp\5C98.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\5DF0.tmp"C:\Users\Admin\AppData\Local\Temp\5DF0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\5EFA.tmp"C:\Users\Admin\AppData\Local\Temp\5EFA.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\5FF4.tmp"C:\Users\Admin\AppData\Local\Temp\5FF4.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\60CE.tmp"C:\Users\Admin\AppData\Local\Temp\60CE.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\6245.tmp"C:\Users\Admin\AppData\Local\Temp\6245.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\637E.tmp"C:\Users\Admin\AppData\Local\Temp\637E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\64D6.tmp"C:\Users\Admin\AppData\Local\Temp\64D6.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\665C.tmp"C:\Users\Admin\AppData\Local\Temp\665C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\6776.tmp"C:\Users\Admin\AppData\Local\Temp\6776.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\689E.tmp"C:\Users\Admin\AppData\Local\Temp\689E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\69C7.tmp"C:\Users\Admin\AppData\Local\Temp\69C7.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\6AD1.tmp"C:\Users\Admin\AppData\Local\Temp\6AD1.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\6BBB.tmp"C:\Users\Admin\AppData\Local\Temp\6BBB.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\6C58.tmp"C:\Users\Admin\AppData\Local\Temp\6C58.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\6D13.tmp"C:\Users\Admin\AppData\Local\Temp\6D13.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\6DA0.tmp"C:\Users\Admin\AppData\Local\Temp\6DA0.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\6EA9.tmp"C:\Users\Admin\AppData\Local\Temp\6EA9.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\6F65.tmp"C:\Users\Admin\AppData\Local\Temp\6F65.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\7030.tmp"C:\Users\Admin\AppData\Local\Temp\7030.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\70BD.tmp"C:\Users\Admin\AppData\Local\Temp\70BD.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\7178.tmp"C:\Users\Admin\AppData\Local\Temp\7178.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\72DF.tmp"C:\Users\Admin\AppData\Local\Temp\72DF.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\73BA.tmp"C:\Users\Admin\AppData\Local\Temp\73BA.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\7466.tmp"C:\Users\Admin\AppData\Local\Temp\7466.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\7541.tmp"C:\Users\Admin\AppData\Local\Temp\7541.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\760C.tmp"C:\Users\Admin\AppData\Local\Temp\760C.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\76F6.tmp"C:\Users\Admin\AppData\Local\Temp\76F6.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\77D1.tmp"C:\Users\Admin\AppData\Local\Temp\77D1.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\786D.tmp"C:\Users\Admin\AppData\Local\Temp\786D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\78DB.tmp"C:\Users\Admin\AppData\Local\Temp\78DB.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\7967.tmp"C:\Users\Admin\AppData\Local\Temp\7967.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\79E4.tmp"C:\Users\Admin\AppData\Local\Temp\79E4.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\7A81.tmp"C:\Users\Admin\AppData\Local\Temp\7A81.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\7B1D.tmp"C:\Users\Admin\AppData\Local\Temp\7B1D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"C:\Users\Admin\AppData\Local\Temp\7B8A.tmp"57⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\7C07.tmp"C:\Users\Admin\AppData\Local\Temp\7C07.tmp"58⤵
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\7C75.tmp"C:\Users\Admin\AppData\Local\Temp\7C75.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\7CF2.tmp"C:\Users\Admin\AppData\Local\Temp\7CF2.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\7D7E.tmp"C:\Users\Admin\AppData\Local\Temp\7D7E.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\7E1A.tmp"C:\Users\Admin\AppData\Local\Temp\7E1A.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\7EB7.tmp"C:\Users\Admin\AppData\Local\Temp\7EB7.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\7F53.tmp"C:\Users\Admin\AppData\Local\Temp\7F53.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\7FD0.tmp"C:\Users\Admin\AppData\Local\Temp\7FD0.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\806C.tmp"C:\Users\Admin\AppData\Local\Temp\806C.tmp"66⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\80E9.tmp"C:\Users\Admin\AppData\Local\Temp\80E9.tmp"67⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\8185.tmp"C:\Users\Admin\AppData\Local\Temp\8185.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\8222.tmp"C:\Users\Admin\AppData\Local\Temp\8222.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\828F.tmp"C:\Users\Admin\AppData\Local\Temp\828F.tmp"70⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\832B.tmp"C:\Users\Admin\AppData\Local\Temp\832B.tmp"71⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\83A8.tmp"C:\Users\Admin\AppData\Local\Temp\83A8.tmp"72⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\8435.tmp"C:\Users\Admin\AppData\Local\Temp\8435.tmp"73⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\84C2.tmp"C:\Users\Admin\AppData\Local\Temp\84C2.tmp"74⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\852F.tmp"C:\Users\Admin\AppData\Local\Temp\852F.tmp"75⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\85BC.tmp"C:\Users\Admin\AppData\Local\Temp\85BC.tmp"76⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\8639.tmp"C:\Users\Admin\AppData\Local\Temp\8639.tmp"77⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\86B6.tmp"C:\Users\Admin\AppData\Local\Temp\86B6.tmp"78⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\8733.tmp"C:\Users\Admin\AppData\Local\Temp\8733.tmp"79⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\87BF.tmp"C:\Users\Admin\AppData\Local\Temp\87BF.tmp"80⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\883C.tmp"C:\Users\Admin\AppData\Local\Temp\883C.tmp"81⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\88C9.tmp"C:\Users\Admin\AppData\Local\Temp\88C9.tmp"82⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\8936.tmp"C:\Users\Admin\AppData\Local\Temp\8936.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\89B3.tmp"C:\Users\Admin\AppData\Local\Temp\89B3.tmp"84⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\8A30.tmp"C:\Users\Admin\AppData\Local\Temp\8A30.tmp"85⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\8ABD.tmp"C:\Users\Admin\AppData\Local\Temp\8ABD.tmp"86⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\8B49.tmp"C:\Users\Admin\AppData\Local\Temp\8B49.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\8BE6.tmp"C:\Users\Admin\AppData\Local\Temp\8BE6.tmp"88⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\8C63.tmp"C:\Users\Admin\AppData\Local\Temp\8C63.tmp"89⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\8D0F.tmp"C:\Users\Admin\AppData\Local\Temp\8D0F.tmp"90⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\8D9B.tmp"C:\Users\Admin\AppData\Local\Temp\8D9B.tmp"91⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\8E28.tmp"C:\Users\Admin\AppData\Local\Temp\8E28.tmp"92⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\8EB4.tmp"C:\Users\Admin\AppData\Local\Temp\8EB4.tmp"93⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\8F51.tmp"C:\Users\Admin\AppData\Local\Temp\8F51.tmp"94⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\8FED.tmp"C:\Users\Admin\AppData\Local\Temp\8FED.tmp"95⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\9089.tmp"C:\Users\Admin\AppData\Local\Temp\9089.tmp"96⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\9106.tmp"C:\Users\Admin\AppData\Local\Temp\9106.tmp"97⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\9183.tmp"C:\Users\Admin\AppData\Local\Temp\9183.tmp"98⤵PID:256
-
C:\Users\Admin\AppData\Local\Temp\921F.tmp"C:\Users\Admin\AppData\Local\Temp\921F.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:468 -
C:\Users\Admin\AppData\Local\Temp\92AC.tmp"C:\Users\Admin\AppData\Local\Temp\92AC.tmp"100⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\9329.tmp"C:\Users\Admin\AppData\Local\Temp\9329.tmp"101⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\93F4.tmp"C:\Users\Admin\AppData\Local\Temp\93F4.tmp"102⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\9471.tmp"C:\Users\Admin\AppData\Local\Temp\9471.tmp"103⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\950D.tmp"C:\Users\Admin\AppData\Local\Temp\950D.tmp"104⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\958A.tmp"C:\Users\Admin\AppData\Local\Temp\958A.tmp"105⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\9617.tmp"C:\Users\Admin\AppData\Local\Temp\9617.tmp"106⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\9684.tmp"C:\Users\Admin\AppData\Local\Temp\9684.tmp"107⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\9730.tmp"C:\Users\Admin\AppData\Local\Temp\9730.tmp"108⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\97BD.tmp"C:\Users\Admin\AppData\Local\Temp\97BD.tmp"109⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\984A.tmp"C:\Users\Admin\AppData\Local\Temp\984A.tmp"110⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\98C7.tmp"C:\Users\Admin\AppData\Local\Temp\98C7.tmp"111⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\9953.tmp"C:\Users\Admin\AppData\Local\Temp\9953.tmp"112⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\99FF.tmp"C:\Users\Admin\AppData\Local\Temp\99FF.tmp"113⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\9A7C.tmp"C:\Users\Admin\AppData\Local\Temp\9A7C.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:244 -
C:\Users\Admin\AppData\Local\Temp\9B09.tmp"C:\Users\Admin\AppData\Local\Temp\9B09.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\9B86.tmp"C:\Users\Admin\AppData\Local\Temp\9B86.tmp"116⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\9BF3.tmp"C:\Users\Admin\AppData\Local\Temp\9BF3.tmp"117⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\9C70.tmp"C:\Users\Admin\AppData\Local\Temp\9C70.tmp"118⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\9CED.tmp"C:\Users\Admin\AppData\Local\Temp\9CED.tmp"119⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\9D7A.tmp"C:\Users\Admin\AppData\Local\Temp\9D7A.tmp"120⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\9E06.tmp"C:\Users\Admin\AppData\Local\Temp\9E06.tmp"121⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\9E93.tmp"C:\Users\Admin\AppData\Local\Temp\9E93.tmp"122⤵PID:4024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-