Analysis
- max time kernel
115s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 15:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_b0be0c56ad96399cffa01e08ee2e3282_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_b0be0c56ad96399cffa01e08ee2e3282_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-07-20_b0be0c56ad96399cffa01e08ee2e3282_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260720-s2c5csgx2x
- SHA256 100e15f072368e171ba50af9b1dd8a76c860afffa13f1559ab03e70a7bdd11cd
- MD5 b0be0c56ad96399cffa01e08ee2e3282
- SHA1 cc0771e06be431edb82480c637539c0326d55eaf
- SHA512 a6b99ebbb1c53d5f84e3226fe97a56352dacf82d2745889cf5ab26b006b5d0aec23d79944fe511457000cc22aab126d70ce8cb973d0099ee55f81e77ac47ded3
- SSDEEP 12288:HU5rCOTeiJLpq6RTXjT0Ve5XwQo4WXK2GNZ:HUQOJJFvrF5UAN
- TLSH T151B4F022B989C032EA9202354BE6EBB1197ABC714725A4C73BD4772E6FB12D1D774343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5224 3E96.tmp 5780 3F41.tmp 1584 3FFD.tmp 3808 40A9.tmp 2324 4135.tmp 4224 41D2.tmp 2404 429D.tmp 1712 4358.tmp 2928 4404.tmp 5440 44FE.tmp 2276 45BA.tmp 5052 4666.tmp 3360 4711.tmp 4844 47BD.tmp 3828 4888.tmp 208 4954.tmp 2668 49F0.tmp 5384 4A8C.tmp 1224 4B28.tmp 3012 4BC5.tmp 4356 4CAF.tmp 3048 4D6A.tmp 5508 4DF7.tmp 6104 4EE1.tmp 3796 4F9D.tmp 2608 5068.tmp 3084 50F5.tmp 5860 5191.tmp 1932 522D.tmp 3716 52D9.tmp 3392 5395.tmp 6020 5450.tmp 940 550C.tmp 792 5579.tmp 5848 55F6.tmp 5420 5663.tmp 3472 56D1.tmp 4232 576D.tmp 5492 57EA.tmp 2468 5877.tmp 1052 58E4.tmp 5872 5961.tmp 3088 59CE.tmp 3328 5A3C.tmp 1852 5AA9.tmp 2972 5B16.tmp 5360 5BC2.tmp 4280 5C5F.tmp 1072 5CEB.tmp 3960 5D59.tmp 2052 5DF5.tmp 876 5E62.tmp 4776 5EDF.tmp 4692 5F6C.tmp 4788 5FF8.tmp 2764 6085.tmp 3832 6102.tmp 2644 617F.tmp 3528 61FC.tmp 5008 6289.tmp 3940 6325.tmp 6000 63B2.tmp 1420 641F.tmp 2272 64BB.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E768.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5804.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 641F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 934D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B973.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 919.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7092.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E46B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1629.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F619.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3077.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 159C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C005.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B491.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C52B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4548.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 510F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2193.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 617F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AADC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C739.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1756 wrote to memory of 5224 1756 2026-07-20_b0be0c56ad96399cffa01e08ee2e3282_elex_mafia_stealc_tofsee.exe 89 PID 5224 wrote to memory of 5780 5224 3E96.tmp 90 PID 5780 wrote to memory of 1584 5780 3F41.tmp 91 PID 1584 wrote to memory of 3808 1584 3FFD.tmp 92 PID 3808 wrote to memory of 2324 3808 40A9.tmp 93 PID 2324 wrote to memory of 4224 2324 4135.tmp 94 PID 4224 wrote to memory of 2404 4224 41D2.tmp 95 PID 2404 wrote to memory of 1712 2404 429D.tmp 96 PID 1712 wrote to memory of 2928 1712 4358.tmp 97 PID 2928 wrote to memory of 5440 2928 4404.tmp 98 PID 5440 wrote to memory of 2276 5440 44FE.tmp 99 PID 2276 wrote to memory of 5052 2276 45BA.tmp 100 PID 5052 wrote to memory of 3360 5052 4666.tmp 101 PID 3360 wrote to memory of 4844 3360 4711.tmp 102 PID 4844 wrote to memory of 3828 4844 47BD.tmp 103 PID 3828 wrote to memory of 208 3828 4888.tmp 104 PID 208 wrote to memory of 2668 208 4954.tmp 105 PID 2668 wrote to memory of 5384 2668 49F0.tmp 106 PID 5384 wrote to memory of 1224 5384 4A8C.tmp 107 PID 1224 wrote to memory of 3012 1224 4B28.tmp 108 PID 3012 wrote to memory of 4356 3012 4BC5.tmp 109 PID 4356 wrote to memory of 3048 4356 4CAF.tmp 110 PID 3048 wrote to memory of 5508 3048 4D6A.tmp 111 PID 5508 wrote to memory of 6104 5508 4DF7.tmp 112 PID 6104 wrote to memory of 3796 6104 4EE1.tmp 113 PID 3796 wrote to memory of 2608 3796 4F9D.tmp 114 PID 2608 wrote to memory of 3084 2608 5068.tmp 115 PID 3084 wrote to memory of 5860 3084 50F5.tmp 116 PID 5860 wrote to memory of 1932 5860 5191.tmp 117 PID 1932 wrote to memory of 3716 1932 522D.tmp 118 PID 3716 wrote to memory of 3392 3716 52D9.tmp 119 PID 3392 wrote to memory of 6020 3392 5395.tmp 120 PID 6020 wrote to memory of 940 6020 5450.tmp 121 PID 940 wrote to memory of 792 940 550C.tmp 122 PID 792 wrote to memory of 5848 792 5579.tmp 123 PID 5848 wrote to memory of 5420 5848 55F6.tmp 124 PID 5420 wrote to memory of 3472 5420 5663.tmp 125 PID 3472 wrote to memory of 4232 3472 56D1.tmp 126 PID 4232 wrote to memory of 5492 4232 576D.tmp 127 PID 5492 wrote to memory of 2468 5492 57EA.tmp 128 PID 2468 wrote to memory of 1052 2468 5877.tmp 129 PID 1052 wrote to memory of 5872 1052 58E4.tmp 130 PID 5872 wrote to memory of 3088 5872 5961.tmp 131 PID 3088 wrote to memory of 3328 3088 59CE.tmp 132 PID 3328 wrote to memory of 1852 3328 5A3C.tmp 133 PID 1852 wrote to memory of 2972 1852 5AA9.tmp 134 PID 2972 wrote to memory of 5360 2972 5B16.tmp 135 PID 5360 wrote to memory of 4280 5360 5BC2.tmp 136 PID 4280 wrote to memory of 1072 4280 5C5F.tmp 137 PID 1072 wrote to memory of 3960 1072 5CEB.tmp 138 PID 3960 wrote to memory of 2052 3960 5D59.tmp 139 PID 2052 wrote to memory of 876 2052 5DF5.tmp 140 PID 876 wrote to memory of 4776 876 5E62.tmp 141 PID 4776 wrote to memory of 4692 4776 5EDF.tmp 142 PID 4692 wrote to memory of 4788 4692 5F6C.tmp 143 PID 4788 wrote to memory of 2764 4788 5FF8.tmp 144 PID 2764 wrote to memory of 3832 2764 6085.tmp 145 PID 3832 wrote to memory of 2644 3832 6102.tmp 146 PID 2644 wrote to memory of 3528 2644 617F.tmp 147 PID 3528 wrote to memory of 5008 3528 61FC.tmp 148 PID 5008 wrote to memory of 3940 5008 6289.tmp 149 PID 3940 wrote to memory of 6000 3940 6325.tmp 150 PID 6000 wrote to memory of 1420 6000 63B2.tmp 151 PID 1420 wrote to memory of 2272 1420 641F.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_b0be0c56ad96399cffa01e08ee2e3282_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_b0be0c56ad96399cffa01e08ee2e3282_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\3F41.tmp"C:\Users\Admin\AppData\Local\Temp\3F41.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\40A9.tmp"C:\Users\Admin\AppData\Local\Temp\40A9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\41D2.tmp"C:\Users\Admin\AppData\Local\Temp\41D2.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\429D.tmp"C:\Users\Admin\AppData\Local\Temp\429D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\4358.tmp"C:\Users\Admin\AppData\Local\Temp\4358.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\4404.tmp"C:\Users\Admin\AppData\Local\Temp\4404.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\44FE.tmp"C:\Users\Admin\AppData\Local\Temp\44FE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\45BA.tmp"C:\Users\Admin\AppData\Local\Temp\45BA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\4666.tmp"C:\Users\Admin\AppData\Local\Temp\4666.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\4711.tmp"C:\Users\Admin\AppData\Local\Temp\4711.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\47BD.tmp"C:\Users\Admin\AppData\Local\Temp\47BD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\4888.tmp"C:\Users\Admin\AppData\Local\Temp\4888.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\4954.tmp"C:\Users\Admin\AppData\Local\Temp\4954.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\49F0.tmp"C:\Users\Admin\AppData\Local\Temp\49F0.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\4A8C.tmp"C:\Users\Admin\AppData\Local\Temp\4A8C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\4B28.tmp"C:\Users\Admin\AppData\Local\Temp\4B28.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\4BC5.tmp"C:\Users\Admin\AppData\Local\Temp\4BC5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\4D6A.tmp"C:\Users\Admin\AppData\Local\Temp\4D6A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\4DF7.tmp"C:\Users\Admin\AppData\Local\Temp\4DF7.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\5068.tmp"C:\Users\Admin\AppData\Local\Temp\5068.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\50F5.tmp"C:\Users\Admin\AppData\Local\Temp\50F5.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\5191.tmp"C:\Users\Admin\AppData\Local\Temp\5191.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\522D.tmp"C:\Users\Admin\AppData\Local\Temp\522D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\52D9.tmp"C:\Users\Admin\AppData\Local\Temp\52D9.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\5395.tmp"C:\Users\Admin\AppData\Local\Temp\5395.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\5450.tmp"C:\Users\Admin\AppData\Local\Temp\5450.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\550C.tmp"C:\Users\Admin\AppData\Local\Temp\550C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\5579.tmp"C:\Users\Admin\AppData\Local\Temp\5579.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\55F6.tmp"C:\Users\Admin\AppData\Local\Temp\55F6.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\5663.tmp"C:\Users\Admin\AppData\Local\Temp\5663.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\56D1.tmp"C:\Users\Admin\AppData\Local\Temp\56D1.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\576D.tmp"C:\Users\Admin\AppData\Local\Temp\576D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\57EA.tmp"C:\Users\Admin\AppData\Local\Temp\57EA.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\5877.tmp"C:\Users\Admin\AppData\Local\Temp\5877.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\58E4.tmp"C:\Users\Admin\AppData\Local\Temp\58E4.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\5961.tmp"C:\Users\Admin\AppData\Local\Temp\5961.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\59CE.tmp"C:\Users\Admin\AppData\Local\Temp\59CE.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\5A3C.tmp"C:\Users\Admin\AppData\Local\Temp\5A3C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\5AA9.tmp"C:\Users\Admin\AppData\Local\Temp\5AA9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\5B16.tmp"C:\Users\Admin\AppData\Local\Temp\5B16.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\5BC2.tmp"C:\Users\Admin\AppData\Local\Temp\5BC2.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\5C5F.tmp"C:\Users\Admin\AppData\Local\Temp\5C5F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\5CEB.tmp"C:\Users\Admin\AppData\Local\Temp\5CEB.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\5D59.tmp"C:\Users\Admin\AppData\Local\Temp\5D59.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\5DF5.tmp"C:\Users\Admin\AppData\Local\Temp\5DF5.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\5E62.tmp"C:\Users\Admin\AppData\Local\Temp\5E62.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\5EDF.tmp"C:\Users\Admin\AppData\Local\Temp\5EDF.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\5F6C.tmp"C:\Users\Admin\AppData\Local\Temp\5F6C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\5FF8.tmp"C:\Users\Admin\AppData\Local\Temp\5FF8.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\6085.tmp"C:\Users\Admin\AppData\Local\Temp\6085.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\6102.tmp"C:\Users\Admin\AppData\Local\Temp\6102.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\617F.tmp"C:\Users\Admin\AppData\Local\Temp\617F.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\61FC.tmp"C:\Users\Admin\AppData\Local\Temp\61FC.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\6289.tmp"C:\Users\Admin\AppData\Local\Temp\6289.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\6325.tmp"C:\Users\Admin\AppData\Local\Temp\6325.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\63B2.tmp"C:\Users\Admin\AppData\Local\Temp\63B2.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\641F.tmp"C:\Users\Admin\AppData\Local\Temp\641F.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\64BB.tmp"C:\Users\Admin\AppData\Local\Temp\64BB.tmp"65⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\6557.tmp"C:\Users\Admin\AppData\Local\Temp\6557.tmp"66⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\65E4.tmp"C:\Users\Admin\AppData\Local\Temp\65E4.tmp"67⤵PID:5604
-
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"68⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"69⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\675B.tmp"C:\Users\Admin\AppData\Local\Temp\675B.tmp"70⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\67E8.tmp"C:\Users\Admin\AppData\Local\Temp\67E8.tmp"71⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\6884.tmp"C:\Users\Admin\AppData\Local\Temp\6884.tmp"72⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\6901.tmp"C:\Users\Admin\AppData\Local\Temp\6901.tmp"73⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\697E.tmp"C:\Users\Admin\AppData\Local\Temp\697E.tmp"74⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\69FB.tmp"C:\Users\Admin\AppData\Local\Temp\69FB.tmp"75⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\6A88.tmp"C:\Users\Admin\AppData\Local\Temp\6A88.tmp"76⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\6B14.tmp"C:\Users\Admin\AppData\Local\Temp\6B14.tmp"77⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\6BA1.tmp"C:\Users\Admin\AppData\Local\Temp\6BA1.tmp"78⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\6C1E.tmp"C:\Users\Admin\AppData\Local\Temp\6C1E.tmp"79⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"80⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\6D37.tmp"C:\Users\Admin\AppData\Local\Temp\6D37.tmp"81⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"82⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\6E31.tmp"C:\Users\Admin\AppData\Local\Temp\6E31.tmp"83⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\6EAE.tmp"C:\Users\Admin\AppData\Local\Temp\6EAE.tmp"84⤵PID:504
-
C:\Users\Admin\AppData\Local\Temp\6F0C.tmp"C:\Users\Admin\AppData\Local\Temp\6F0C.tmp"85⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\6F89.tmp"C:\Users\Admin\AppData\Local\Temp\6F89.tmp"86⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\7006.tmp"C:\Users\Admin\AppData\Local\Temp\7006.tmp"87⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\7092.tmp"C:\Users\Admin\AppData\Local\Temp\7092.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\7100.tmp"C:\Users\Admin\AppData\Local\Temp\7100.tmp"89⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\718C.tmp"C:\Users\Admin\AppData\Local\Temp\718C.tmp"90⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\7219.tmp"C:\Users\Admin\AppData\Local\Temp\7219.tmp"91⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\7296.tmp"C:\Users\Admin\AppData\Local\Temp\7296.tmp"92⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\7323.tmp"C:\Users\Admin\AppData\Local\Temp\7323.tmp"93⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\73A0.tmp"C:\Users\Admin\AppData\Local\Temp\73A0.tmp"94⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\741D.tmp"C:\Users\Admin\AppData\Local\Temp\741D.tmp"95⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\74B9.tmp"C:\Users\Admin\AppData\Local\Temp\74B9.tmp"96⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\7546.tmp"C:\Users\Admin\AppData\Local\Temp\7546.tmp"97⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\75C3.tmp"C:\Users\Admin\AppData\Local\Temp\75C3.tmp"98⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\765F.tmp"C:\Users\Admin\AppData\Local\Temp\765F.tmp"99⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\76CC.tmp"C:\Users\Admin\AppData\Local\Temp\76CC.tmp"100⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\7749.tmp"C:\Users\Admin\AppData\Local\Temp\7749.tmp"101⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\77C6.tmp"C:\Users\Admin\AppData\Local\Temp\77C6.tmp"102⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\7843.tmp"C:\Users\Admin\AppData\Local\Temp\7843.tmp"103⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\78C0.tmp"C:\Users\Admin\AppData\Local\Temp\78C0.tmp"104⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\793D.tmp"C:\Users\Admin\AppData\Local\Temp\793D.tmp"105⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\79AB.tmp"C:\Users\Admin\AppData\Local\Temp\79AB.tmp"106⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\7A28.tmp"C:\Users\Admin\AppData\Local\Temp\7A28.tmp"107⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\7AD3.tmp"C:\Users\Admin\AppData\Local\Temp\7AD3.tmp"108⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\7B50.tmp"C:\Users\Admin\AppData\Local\Temp\7B50.tmp"109⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"110⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\7C79.tmp"C:\Users\Admin\AppData\Local\Temp\7C79.tmp"111⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\7D06.tmp"C:\Users\Admin\AppData\Local\Temp\7D06.tmp"112⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\7D93.tmp"C:\Users\Admin\AppData\Local\Temp\7D93.tmp"113⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"114⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\7EAC.tmp"C:\Users\Admin\AppData\Local\Temp\7EAC.tmp"115⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\7F29.tmp"C:\Users\Admin\AppData\Local\Temp\7F29.tmp"116⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\7FA6.tmp"C:\Users\Admin\AppData\Local\Temp\7FA6.tmp"117⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\8023.tmp"C:\Users\Admin\AppData\Local\Temp\8023.tmp"118⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\80AF.tmp"C:\Users\Admin\AppData\Local\Temp\80AF.tmp"119⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\813C.tmp"C:\Users\Admin\AppData\Local\Temp\813C.tmp"120⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\81B9.tmp"C:\Users\Admin\AppData\Local\Temp\81B9.tmp"121⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\8226.tmp"C:\Users\Admin\AppData\Local\Temp\8226.tmp"122⤵PID:2020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-