Analysis
- max time kernel
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 03:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_629cb08d3033309c965ef8954b0f47b6_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_629cb08d3033309c965ef8954b0f47b6_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-07-17_629cb08d3033309c965ef8954b0f47b6_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260718-d6d5wsav4w
- SHA256 c75a7d230fb23182fa9f7540b1a17edb2805fdb5223749653a627b05715b23d7
- MD5 629cb08d3033309c965ef8954b0f47b6
- SHA1 a1e179b45092c9c559518d667809cc53a70507e1
- SHA512 bcb815078f60aae83d5f29f4c8b6f13c2df3664beaaaa2f7ed3edc404c52c039de50111820973284502578a6d3fb80eb3503cd83df0d8e7cb4c0de5c8a4cf89f
- SSDEEP 6144:qorf3lPvovsgZnqG2C7mOTeiL9DUckBkAeO+3EuNH4Vf6l5bZsRGMzII+KxetGsz:HU5rCOTeiJ6/eOVuNll8RlzG3NZ
- TLSH T191B4E125B484C032F69211354AE6EB722A3A7D318726A4C73BD0677E6FB53E1A375307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4116 F9AD.tmp 4488 FA68.tmp 4124 FB43.tmp 4680 FBFF.tmp 1212 FC8B.tmp 4652 FD47.tmp 3596 FE12.tmp 5512 FEAE.tmp 5396 FF79.tmp 4300 A2.tmp 4316 16D.tmp 476 1FA.tmp 2600 296.tmp 6044 361.tmp 1444 41D.tmp 1364 4C9.tmp 4272 565.tmp 4904 5F2.tmp 4976 6CC.tmp 360 778.tmp 4520 824.tmp 4628 8C0.tmp 5488 93D.tmp 2144 9E9.tmp 428 A85.tmp 4432 B22.tmp 6092 C0C.tmp 5392 C89.tmp 472 D73.tmp 5552 E10.tmp 2824 EEA.tmp 4108 F77.tmp 4384 1033.tmp 756 10B0.tmp 4948 113C.tmp 4988 11B9.tmp 1360 1227.tmp 1516 1294.tmp 6108 1301.tmp 4264 137E.tmp 5760 13EC.tmp 3868 1488.tmp 1920 14F5.tmp 1732 1572.tmp 6068 15EF.tmp 4852 167C.tmp 1168 16F9.tmp 2000 1776.tmp 3092 1803.tmp 4172 188F.tmp 2056 190C.tmp 2172 1989.tmp 1884 1A06.tmp 5832 1A83.tmp 4548 1B00.tmp 5820 1B7D.tmp 4464 1C0A.tmp 2784 1C87.tmp 2948 1CE5.tmp 5472 1D62.tmp 5580 1DDF.tmp 4936 1E4C.tmp 1276 1ED9.tmp 3120 1F56.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D095.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6870.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C11F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D112.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 259A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1301.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B53D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ABF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 431A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A186.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 619E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B547.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 740D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A520.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3222.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 622B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 797C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E919.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 284E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9AD.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5124 wrote to memory of 4116 5124 2026-07-17_629cb08d3033309c965ef8954b0f47b6_elex_mafia_stealc_tofsee.exe 89 PID 4116 wrote to memory of 4488 4116 F9AD.tmp 90 PID 4488 wrote to memory of 4124 4488 FA68.tmp 91 PID 4124 wrote to memory of 4680 4124 FB43.tmp 92 PID 4680 wrote to memory of 1212 4680 FBFF.tmp 93 PID 1212 wrote to memory of 4652 1212 FC8B.tmp 94 PID 4652 wrote to memory of 3596 4652 FD47.tmp 95 PID 3596 wrote to memory of 5512 3596 FE12.tmp 96 PID 5512 wrote to memory of 5396 5512 FEAE.tmp 97 PID 5396 wrote to memory of 4300 5396 FF79.tmp 98 PID 4300 wrote to memory of 4316 4300 A2.tmp 99 PID 4316 wrote to memory of 476 4316 16D.tmp 100 PID 476 wrote to memory of 2600 476 1FA.tmp 101 PID 2600 wrote to memory of 6044 2600 296.tmp 102 PID 6044 wrote to memory of 1444 6044 361.tmp 103 PID 1444 wrote to memory of 1364 1444 41D.tmp 104 PID 1364 wrote to memory of 4272 1364 4C9.tmp 105 PID 4272 wrote to memory of 4904 4272 565.tmp 106 PID 4904 wrote to memory of 4976 4904 5F2.tmp 107 PID 4976 wrote to memory of 360 4976 6CC.tmp 108 PID 360 wrote to memory of 4520 360 778.tmp 109 PID 4520 wrote to memory of 4628 4520 824.tmp 110 PID 4628 wrote to memory of 5488 4628 8C0.tmp 111 PID 5488 wrote to memory of 2144 5488 93D.tmp 112 PID 2144 wrote to memory of 428 2144 9E9.tmp 113 PID 428 wrote to memory of 4432 428 A85.tmp 114 PID 4432 wrote to memory of 6092 4432 B22.tmp 115 PID 6092 wrote to memory of 5392 6092 C0C.tmp 116 PID 5392 wrote to memory of 472 5392 C89.tmp 117 PID 472 wrote to memory of 5552 472 D73.tmp 118 PID 5552 wrote to memory of 2824 5552 E10.tmp 119 PID 2824 wrote to memory of 4108 2824 EEA.tmp 120 PID 4108 wrote to memory of 4384 4108 F77.tmp 121 PID 4384 wrote to memory of 756 4384 1033.tmp 122 PID 756 wrote to memory of 4948 756 10B0.tmp 123 PID 4948 wrote to memory of 4988 4948 113C.tmp 124 PID 4988 wrote to memory of 1360 4988 11B9.tmp 125 PID 1360 wrote to memory of 1516 1360 1227.tmp 126 PID 1516 wrote to memory of 6108 1516 1294.tmp 127 PID 6108 wrote to memory of 4264 6108 1301.tmp 128 PID 4264 wrote to memory of 5760 4264 137E.tmp 129 PID 5760 wrote to memory of 3868 5760 13EC.tmp 130 PID 3868 wrote to memory of 1920 3868 1488.tmp 131 PID 1920 wrote to memory of 1732 1920 14F5.tmp 132 PID 1732 wrote to memory of 6068 1732 1572.tmp 133 PID 6068 wrote to memory of 4852 6068 15EF.tmp 134 PID 4852 wrote to memory of 1168 4852 167C.tmp 135 PID 1168 wrote to memory of 2000 1168 16F9.tmp 136 PID 2000 wrote to memory of 3092 2000 1776.tmp 137 PID 3092 wrote to memory of 4172 3092 1803.tmp 138 PID 4172 wrote to memory of 2056 4172 188F.tmp 139 PID 2056 wrote to memory of 2172 2056 190C.tmp 140 PID 2172 wrote to memory of 1884 2172 1989.tmp 141 PID 1884 wrote to memory of 5832 1884 1A06.tmp 142 PID 5832 wrote to memory of 4548 5832 1A83.tmp 143 PID 4548 wrote to memory of 5820 4548 1B00.tmp 144 PID 5820 wrote to memory of 4464 5820 1B7D.tmp 145 PID 4464 wrote to memory of 2784 4464 1C0A.tmp 146 PID 2784 wrote to memory of 2948 2784 1C87.tmp 147 PID 2948 wrote to memory of 5472 2948 1CE5.tmp 148 PID 5472 wrote to memory of 5580 5472 1D62.tmp 149 PID 5580 wrote to memory of 4936 5580 1DDF.tmp 150 PID 4936 wrote to memory of 1276 4936 1E4C.tmp 151 PID 1276 wrote to memory of 3120 1276 1ED9.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_629cb08d3033309c965ef8954b0f47b6_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_629cb08d3033309c965ef8954b0f47b6_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\F9AD.tmp"C:\Users\Admin\AppData\Local\Temp\F9AD.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\FA68.tmp"C:\Users\Admin\AppData\Local\Temp\FA68.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\FB43.tmp"C:\Users\Admin\AppData\Local\Temp\FB43.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\FC8B.tmp"C:\Users\Admin\AppData\Local\Temp\FC8B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\FD47.tmp"C:\Users\Admin\AppData\Local\Temp\FD47.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\FE12.tmp"C:\Users\Admin\AppData\Local\Temp\FE12.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\FEAE.tmp"C:\Users\Admin\AppData\Local\Temp\FEAE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\FF79.tmp"C:\Users\Admin\AppData\Local\Temp\FF79.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\A2.tmp"C:\Users\Admin\AppData\Local\Temp\A2.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\16D.tmp"C:\Users\Admin\AppData\Local\Temp\16D.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\1FA.tmp"C:\Users\Admin\AppData\Local\Temp\1FA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Users\Admin\AppData\Local\Temp\296.tmp"C:\Users\Admin\AppData\Local\Temp\296.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\361.tmp"C:\Users\Admin\AppData\Local\Temp\361.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\41D.tmp"C:\Users\Admin\AppData\Local\Temp\41D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\4C9.tmp"C:\Users\Admin\AppData\Local\Temp\4C9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\565.tmp"C:\Users\Admin\AppData\Local\Temp\565.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\5F2.tmp"C:\Users\Admin\AppData\Local\Temp\5F2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\6CC.tmp"C:\Users\Admin\AppData\Local\Temp\6CC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\778.tmp"C:\Users\Admin\AppData\Local\Temp\778.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\824.tmp"C:\Users\Admin\AppData\Local\Temp\824.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\8C0.tmp"C:\Users\Admin\AppData\Local\Temp\8C0.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\93D.tmp"C:\Users\Admin\AppData\Local\Temp\93D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\9E9.tmp"C:\Users\Admin\AppData\Local\Temp\9E9.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\A85.tmp"C:\Users\Admin\AppData\Local\Temp\A85.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Users\Admin\AppData\Local\Temp\B22.tmp"C:\Users\Admin\AppData\Local\Temp\B22.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\C0C.tmp"C:\Users\Admin\AppData\Local\Temp\C0C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\C89.tmp"C:\Users\Admin\AppData\Local\Temp\C89.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\D73.tmp"C:\Users\Admin\AppData\Local\Temp\D73.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\E10.tmp"C:\Users\Admin\AppData\Local\Temp\E10.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\EEA.tmp"C:\Users\Admin\AppData\Local\Temp\EEA.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\F77.tmp"C:\Users\Admin\AppData\Local\Temp\F77.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\1033.tmp"C:\Users\Admin\AppData\Local\Temp\1033.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\10B0.tmp"C:\Users\Admin\AppData\Local\Temp\10B0.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\113C.tmp"C:\Users\Admin\AppData\Local\Temp\113C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\11B9.tmp"C:\Users\Admin\AppData\Local\Temp\11B9.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\1227.tmp"C:\Users\Admin\AppData\Local\Temp\1227.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\1294.tmp"C:\Users\Admin\AppData\Local\Temp\1294.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\1301.tmp"C:\Users\Admin\AppData\Local\Temp\1301.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\137E.tmp"C:\Users\Admin\AppData\Local\Temp\137E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\13EC.tmp"C:\Users\Admin\AppData\Local\Temp\13EC.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\1488.tmp"C:\Users\Admin\AppData\Local\Temp\1488.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\14F5.tmp"C:\Users\Admin\AppData\Local\Temp\14F5.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\1572.tmp"C:\Users\Admin\AppData\Local\Temp\1572.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\15EF.tmp"C:\Users\Admin\AppData\Local\Temp\15EF.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\167C.tmp"C:\Users\Admin\AppData\Local\Temp\167C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\16F9.tmp"C:\Users\Admin\AppData\Local\Temp\16F9.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\1776.tmp"C:\Users\Admin\AppData\Local\Temp\1776.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\188F.tmp"C:\Users\Admin\AppData\Local\Temp\188F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\190C.tmp"C:\Users\Admin\AppData\Local\Temp\190C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\1A06.tmp"C:\Users\Admin\AppData\Local\Temp\1A06.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\1B7D.tmp"C:\Users\Admin\AppData\Local\Temp\1B7D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\1C0A.tmp"C:\Users\Admin\AppData\Local\Temp\1C0A.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\1C87.tmp"C:\Users\Admin\AppData\Local\Temp\1C87.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\1CE5.tmp"C:\Users\Admin\AppData\Local\Temp\1CE5.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\1D62.tmp"C:\Users\Admin\AppData\Local\Temp\1D62.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\1DDF.tmp"C:\Users\Admin\AppData\Local\Temp\1DDF.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\1E4C.tmp"C:\Users\Admin\AppData\Local\Temp\1E4C.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\1ED9.tmp"C:\Users\Admin\AppData\Local\Temp\1ED9.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\1F56.tmp"C:\Users\Admin\AppData\Local\Temp\1F56.tmp"65⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\1FC3.tmp"C:\Users\Admin\AppData\Local\Temp\1FC3.tmp"66⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\2050.tmp"C:\Users\Admin\AppData\Local\Temp\2050.tmp"67⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\20BD.tmp"C:\Users\Admin\AppData\Local\Temp\20BD.tmp"68⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\213A.tmp"C:\Users\Admin\AppData\Local\Temp\213A.tmp"69⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\21A7.tmp"C:\Users\Admin\AppData\Local\Temp\21A7.tmp"70⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\2224.tmp"C:\Users\Admin\AppData\Local\Temp\2224.tmp"71⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\2292.tmp"C:\Users\Admin\AppData\Local\Temp\2292.tmp"72⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\22FF.tmp"C:\Users\Admin\AppData\Local\Temp\22FF.tmp"73⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\237C.tmp"C:\Users\Admin\AppData\Local\Temp\237C.tmp"74⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\23E9.tmp"C:\Users\Admin\AppData\Local\Temp\23E9.tmp"75⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\2466.tmp"C:\Users\Admin\AppData\Local\Temp\2466.tmp"76⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\2503.tmp"C:\Users\Admin\AppData\Local\Temp\2503.tmp"77⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\2580.tmp"C:\Users\Admin\AppData\Local\Temp\2580.tmp"78⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\25FD.tmp"C:\Users\Admin\AppData\Local\Temp\25FD.tmp"79⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\266A.tmp"C:\Users\Admin\AppData\Local\Temp\266A.tmp"80⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\26C8.tmp"C:\Users\Admin\AppData\Local\Temp\26C8.tmp"81⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\2745.tmp"C:\Users\Admin\AppData\Local\Temp\2745.tmp"82⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\27D1.tmp"C:\Users\Admin\AppData\Local\Temp\27D1.tmp"83⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\284E.tmp"C:\Users\Admin\AppData\Local\Temp\284E.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\28DB.tmp"C:\Users\Admin\AppData\Local\Temp\28DB.tmp"85⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\2968.tmp"C:\Users\Admin\AppData\Local\Temp\2968.tmp"86⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\29E5.tmp"C:\Users\Admin\AppData\Local\Temp\29E5.tmp"87⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\2A62.tmp"C:\Users\Admin\AppData\Local\Temp\2A62.tmp"88⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"89⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"90⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\2BE8.tmp"C:\Users\Admin\AppData\Local\Temp\2BE8.tmp"91⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\2C65.tmp"C:\Users\Admin\AppData\Local\Temp\2C65.tmp"92⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"93⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\2D7F.tmp"C:\Users\Admin\AppData\Local\Temp\2D7F.tmp"94⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"95⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"96⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\2F44.tmp"C:\Users\Admin\AppData\Local\Temp\2F44.tmp"97⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"98⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\304D.tmp"C:\Users\Admin\AppData\Local\Temp\304D.tmp"99⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\30BB.tmp"C:\Users\Admin\AppData\Local\Temp\30BB.tmp"100⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\3138.tmp"C:\Users\Admin\AppData\Local\Temp\3138.tmp"101⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\31B5.tmp"C:\Users\Admin\AppData\Local\Temp\31B5.tmp"102⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\3222.tmp"C:\Users\Admin\AppData\Local\Temp\3222.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\329F.tmp"C:\Users\Admin\AppData\Local\Temp\329F.tmp"104⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\32FD.tmp"C:\Users\Admin\AppData\Local\Temp\32FD.tmp"105⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\337A.tmp"C:\Users\Admin\AppData\Local\Temp\337A.tmp"106⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\33E7.tmp"C:\Users\Admin\AppData\Local\Temp\33E7.tmp"107⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\3455.tmp"C:\Users\Admin\AppData\Local\Temp\3455.tmp"108⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\34D2.tmp"C:\Users\Admin\AppData\Local\Temp\34D2.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\354F.tmp"C:\Users\Admin\AppData\Local\Temp\354F.tmp"110⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\35CC.tmp"C:\Users\Admin\AppData\Local\Temp\35CC.tmp"111⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\3639.tmp"C:\Users\Admin\AppData\Local\Temp\3639.tmp"112⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\36E5.tmp"C:\Users\Admin\AppData\Local\Temp\36E5.tmp"113⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\3762.tmp"C:\Users\Admin\AppData\Local\Temp\3762.tmp"114⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\37DF.tmp"C:\Users\Admin\AppData\Local\Temp\37DF.tmp"115⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\384C.tmp"C:\Users\Admin\AppData\Local\Temp\384C.tmp"116⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\38BA.tmp"C:\Users\Admin\AppData\Local\Temp\38BA.tmp"117⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\3946.tmp"C:\Users\Admin\AppData\Local\Temp\3946.tmp"118⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\39C3.tmp"C:\Users\Admin\AppData\Local\Temp\39C3.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\3A50.tmp"C:\Users\Admin\AppData\Local\Temp\3A50.tmp"120⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"121⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"122⤵PID:692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-