Analysis
- max time kernel
118s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 03:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-21_dea07c1209e11ea420e897137c70a890_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-21_dea07c1209e11ea420e897137c70a890_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-21_dea07c1209e11ea420e897137c70a890_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260721-ebzzjsft8w
- SHA256 aea681617ceec8499c34705013d145b083896125d9536d23120ca9fe54a4c25c
- MD5 dea07c1209e11ea420e897137c70a890
- SHA1 03b689167b954a92ba4899c25da84fd897343c2c
- SHA512 e899873f91966eae4cc8ffb337479bb4bff1167408acf982430e3f2993349f7721a1755f5bff90f9eb97f97073953370ebddfacc06e008d996792e75f7236a4a
- SSDEEP 12288:HU5rCOTeiJiNl7TWb+FRpXOR8BOlaQQNZ:HUQOJJijTjRJaaQQN
- TLSH T13EB4F125B285C032E5D202714EE6EBA25A7A7C715B21A0C37BC4777E6EB42E1D379307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5128 2EA7.tmp 5152 2F34.tmp 3504 2FF0.tmp 4332 30CA.tmp 3196 3232.tmp 2992 32DE.tmp 400 33C8.tmp 2652 3474.tmp 5708 353F.tmp 2716 35FA.tmp 5448 36C6.tmp 1000 3781.tmp 4560 37FE.tmp 2920 38BA.tmp 4472 3965.tmp 2132 39F2.tmp 2020 3A9E.tmp 3224 3B59.tmp 2880 3C25.tmp 1904 3CC1.tmp 2124 3D4D.tmp 1784 3DDA.tmp 1960 3E86.tmp 4956 3F70.tmp 2000 400D.tmp 5960 408A.tmp 1448 4145.tmp 5920 423F.tmp 5852 42CC.tmp 5880 4387.tmp 3288 4433.tmp 1912 44B0.tmp 2540 452D.tmp 3380 45BA.tmp 6124 4646.tmp 4224 46B4.tmp 4948 4721.tmp 5832 479E.tmp 696 480B.tmp 1684 4898.tmp 5272 4925.tmp 5704 4992.tmp 4608 4A1F.tmp 5136 4A8C.tmp 5840 4B09.tmp 4576 4B76.tmp 3496 4BF3.tmp 796 4C80.tmp 5984 4CFD.tmp 1404 4D8A.tmp 4732 4DF7.tmp 6020 4E74.tmp 4780 4F01.tmp 5764 4F7E.tmp 4292 4FFB.tmp 3540 5078.tmp 2452 50E5.tmp 5052 5191.tmp 2340 51FE.tmp 5360 527B.tmp 4132 52E9.tmp 4156 5375.tmp 4924 53F2.tmp 520 546F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 327B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 353F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 746B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 257B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A84C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E03F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F83C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9503.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A74D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F58D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3474.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F96A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 794D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B576.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 745.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F202.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2982.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8108.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8534.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7620.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7188.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F265.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3308.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C881.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6901.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEDF.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2984 wrote to memory of 5128 2984 2026-07-21_dea07c1209e11ea420e897137c70a890_elex_mafia_stealc_tofsee.exe 89 PID 5128 wrote to memory of 5152 5128 2EA7.tmp 90 PID 5152 wrote to memory of 3504 5152 2F34.tmp 91 PID 3504 wrote to memory of 4332 3504 2FF0.tmp 92 PID 4332 wrote to memory of 3196 4332 30CA.tmp 93 PID 3196 wrote to memory of 2992 3196 3232.tmp 94 PID 2992 wrote to memory of 400 2992 32DE.tmp 95 PID 400 wrote to memory of 2652 400 33C8.tmp 96 PID 2652 wrote to memory of 5708 2652 3474.tmp 97 PID 5708 wrote to memory of 2716 5708 353F.tmp 98 PID 2716 wrote to memory of 5448 2716 35FA.tmp 99 PID 5448 wrote to memory of 1000 5448 36C6.tmp 100 PID 1000 wrote to memory of 4560 1000 3781.tmp 101 PID 4560 wrote to memory of 2920 4560 37FE.tmp 102 PID 2920 wrote to memory of 4472 2920 38BA.tmp 103 PID 4472 wrote to memory of 2132 4472 3965.tmp 104 PID 2132 wrote to memory of 2020 2132 39F2.tmp 105 PID 2020 wrote to memory of 3224 2020 3A9E.tmp 106 PID 3224 wrote to memory of 2880 3224 3B59.tmp 107 PID 2880 wrote to memory of 1904 2880 3C25.tmp 108 PID 1904 wrote to memory of 2124 1904 3CC1.tmp 109 PID 2124 wrote to memory of 1784 2124 3D4D.tmp 110 PID 1784 wrote to memory of 1960 1784 3DDA.tmp 111 PID 1960 wrote to memory of 4956 1960 3E86.tmp 112 PID 4956 wrote to memory of 2000 4956 3F70.tmp 113 PID 2000 wrote to memory of 5960 2000 400D.tmp 114 PID 5960 wrote to memory of 1448 5960 408A.tmp 115 PID 1448 wrote to memory of 5920 1448 4145.tmp 116 PID 5920 wrote to memory of 5852 5920 423F.tmp 117 PID 5852 wrote to memory of 5880 5852 42CC.tmp 118 PID 5880 wrote to memory of 3288 5880 4387.tmp 119 PID 3288 wrote to memory of 1912 3288 4433.tmp 120 PID 1912 wrote to memory of 2540 1912 44B0.tmp 121 PID 2540 wrote to memory of 3380 2540 452D.tmp 122 PID 3380 wrote to memory of 6124 3380 45BA.tmp 123 PID 6124 wrote to memory of 4224 6124 4646.tmp 124 PID 4224 wrote to memory of 4948 4224 46B4.tmp 125 PID 4948 wrote to memory of 5832 4948 4721.tmp 126 PID 5832 wrote to memory of 696 5832 479E.tmp 127 PID 696 wrote to memory of 1684 696 480B.tmp 128 PID 1684 wrote to memory of 5272 1684 4898.tmp 129 PID 5272 wrote to memory of 5704 5272 4925.tmp 130 PID 5704 wrote to memory of 4608 5704 4992.tmp 131 PID 4608 wrote to memory of 5136 4608 4A1F.tmp 132 PID 5136 wrote to memory of 5840 5136 4A8C.tmp 133 PID 5840 wrote to memory of 4576 5840 4B09.tmp 134 PID 4576 wrote to memory of 3496 4576 4B76.tmp 135 PID 3496 wrote to memory of 796 3496 4BF3.tmp 136 PID 796 wrote to memory of 5984 796 4C80.tmp 137 PID 5984 wrote to memory of 1404 5984 4CFD.tmp 138 PID 1404 wrote to memory of 4732 1404 4D8A.tmp 139 PID 4732 wrote to memory of 6020 4732 4DF7.tmp 140 PID 6020 wrote to memory of 4780 6020 4E74.tmp 141 PID 4780 wrote to memory of 5764 4780 4F01.tmp 142 PID 5764 wrote to memory of 4292 5764 4F7E.tmp 143 PID 4292 wrote to memory of 3540 4292 4FFB.tmp 144 PID 3540 wrote to memory of 2452 3540 5078.tmp 145 PID 2452 wrote to memory of 5052 2452 50E5.tmp 146 PID 5052 wrote to memory of 2340 5052 5191.tmp 147 PID 2340 wrote to memory of 5360 2340 51FE.tmp 148 PID 5360 wrote to memory of 4132 5360 527B.tmp 149 PID 4132 wrote to memory of 4156 4132 52E9.tmp 150 PID 4156 wrote to memory of 4924 4156 5375.tmp 151 PID 4924 wrote to memory of 520 4924 53F2.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_dea07c1209e11ea420e897137c70a890_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_dea07c1209e11ea420e897137c70a890_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\2EA7.tmp"C:\Users\Admin\AppData\Local\Temp\2EA7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\2F34.tmp"C:\Users\Admin\AppData\Local\Temp\2F34.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\2FF0.tmp"C:\Users\Admin\AppData\Local\Temp\2FF0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\30CA.tmp"C:\Users\Admin\AppData\Local\Temp\30CA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\3232.tmp"C:\Users\Admin\AppData\Local\Temp\3232.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\32DE.tmp"C:\Users\Admin\AppData\Local\Temp\32DE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\33C8.tmp"C:\Users\Admin\AppData\Local\Temp\33C8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\3474.tmp"C:\Users\Admin\AppData\Local\Temp\3474.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\353F.tmp"C:\Users\Admin\AppData\Local\Temp\353F.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\35FA.tmp"C:\Users\Admin\AppData\Local\Temp\35FA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\36C6.tmp"C:\Users\Admin\AppData\Local\Temp\36C6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\3781.tmp"C:\Users\Admin\AppData\Local\Temp\3781.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\37FE.tmp"C:\Users\Admin\AppData\Local\Temp\37FE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\38BA.tmp"C:\Users\Admin\AppData\Local\Temp\38BA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\3965.tmp"C:\Users\Admin\AppData\Local\Temp\3965.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\39F2.tmp"C:\Users\Admin\AppData\Local\Temp\39F2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\3B59.tmp"C:\Users\Admin\AppData\Local\Temp\3B59.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\3C25.tmp"C:\Users\Admin\AppData\Local\Temp\3C25.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\3CC1.tmp"C:\Users\Admin\AppData\Local\Temp\3CC1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\3D4D.tmp"C:\Users\Admin\AppData\Local\Temp\3D4D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\3DDA.tmp"C:\Users\Admin\AppData\Local\Temp\3DDA.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\400D.tmp"C:\Users\Admin\AppData\Local\Temp\400D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\408A.tmp"C:\Users\Admin\AppData\Local\Temp\408A.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\4145.tmp"C:\Users\Admin\AppData\Local\Temp\4145.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\423F.tmp"C:\Users\Admin\AppData\Local\Temp\423F.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\42CC.tmp"C:\Users\Admin\AppData\Local\Temp\42CC.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\4387.tmp"C:\Users\Admin\AppData\Local\Temp\4387.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\4433.tmp"C:\Users\Admin\AppData\Local\Temp\4433.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\44B0.tmp"C:\Users\Admin\AppData\Local\Temp\44B0.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\452D.tmp"C:\Users\Admin\AppData\Local\Temp\452D.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\45BA.tmp"C:\Users\Admin\AppData\Local\Temp\45BA.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\4646.tmp"C:\Users\Admin\AppData\Local\Temp\4646.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\46B4.tmp"C:\Users\Admin\AppData\Local\Temp\46B4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\4721.tmp"C:\Users\Admin\AppData\Local\Temp\4721.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\479E.tmp"C:\Users\Admin\AppData\Local\Temp\479E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\480B.tmp"C:\Users\Admin\AppData\Local\Temp\480B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\4898.tmp"C:\Users\Admin\AppData\Local\Temp\4898.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\4925.tmp"C:\Users\Admin\AppData\Local\Temp\4925.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\4992.tmp"C:\Users\Admin\AppData\Local\Temp\4992.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\4A1F.tmp"C:\Users\Admin\AppData\Local\Temp\4A1F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\4A8C.tmp"C:\Users\Admin\AppData\Local\Temp\4A8C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\4B09.tmp"C:\Users\Admin\AppData\Local\Temp\4B09.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\4B76.tmp"C:\Users\Admin\AppData\Local\Temp\4B76.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\4BF3.tmp"C:\Users\Admin\AppData\Local\Temp\4BF3.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\4C80.tmp"C:\Users\Admin\AppData\Local\Temp\4C80.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\4D8A.tmp"C:\Users\Admin\AppData\Local\Temp\4D8A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\4DF7.tmp"C:\Users\Admin\AppData\Local\Temp\4DF7.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\4E74.tmp"C:\Users\Admin\AppData\Local\Temp\4E74.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\4F01.tmp"C:\Users\Admin\AppData\Local\Temp\4F01.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\4FFB.tmp"C:\Users\Admin\AppData\Local\Temp\4FFB.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\5078.tmp"C:\Users\Admin\AppData\Local\Temp\5078.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\50E5.tmp"C:\Users\Admin\AppData\Local\Temp\50E5.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\5191.tmp"C:\Users\Admin\AppData\Local\Temp\5191.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\51FE.tmp"C:\Users\Admin\AppData\Local\Temp\51FE.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\527B.tmp"C:\Users\Admin\AppData\Local\Temp\527B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\52E9.tmp"C:\Users\Admin\AppData\Local\Temp\52E9.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\5375.tmp"C:\Users\Admin\AppData\Local\Temp\5375.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\53F2.tmp"C:\Users\Admin\AppData\Local\Temp\53F2.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\546F.tmp"C:\Users\Admin\AppData\Local\Temp\546F.tmp"65⤵
- Executes dropped EXE
PID:520 -
C:\Users\Admin\AppData\Local\Temp\54FC.tmp"C:\Users\Admin\AppData\Local\Temp\54FC.tmp"66⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\5579.tmp"C:\Users\Admin\AppData\Local\Temp\5579.tmp"67⤵PID:6112
-
C:\Users\Admin\AppData\Local\Temp\5606.tmp"C:\Users\Admin\AppData\Local\Temp\5606.tmp"68⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\5683.tmp"C:\Users\Admin\AppData\Local\Temp\5683.tmp"69⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\56F0.tmp"C:\Users\Admin\AppData\Local\Temp\56F0.tmp"70⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\575D.tmp"C:\Users\Admin\AppData\Local\Temp\575D.tmp"71⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\57DA.tmp"C:\Users\Admin\AppData\Local\Temp\57DA.tmp"72⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\5857.tmp"C:\Users\Admin\AppData\Local\Temp\5857.tmp"73⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\58C5.tmp"C:\Users\Admin\AppData\Local\Temp\58C5.tmp"74⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\5951.tmp"C:\Users\Admin\AppData\Local\Temp\5951.tmp"75⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\59CE.tmp"C:\Users\Admin\AppData\Local\Temp\59CE.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\5A4B.tmp"C:\Users\Admin\AppData\Local\Temp\5A4B.tmp"77⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\5AB9.tmp"C:\Users\Admin\AppData\Local\Temp\5AB9.tmp"78⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\5B26.tmp"C:\Users\Admin\AppData\Local\Temp\5B26.tmp"79⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\5B93.tmp"C:\Users\Admin\AppData\Local\Temp\5B93.tmp"80⤵PID:500
-
C:\Users\Admin\AppData\Local\Temp\5C10.tmp"C:\Users\Admin\AppData\Local\Temp\5C10.tmp"81⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\5C9D.tmp"C:\Users\Admin\AppData\Local\Temp\5C9D.tmp"82⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\5D2A.tmp"C:\Users\Admin\AppData\Local\Temp\5D2A.tmp"83⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\5DB6.tmp"C:\Users\Admin\AppData\Local\Temp\5DB6.tmp"84⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\5E24.tmp"C:\Users\Admin\AppData\Local\Temp\5E24.tmp"85⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\5E91.tmp"C:\Users\Admin\AppData\Local\Temp\5E91.tmp"86⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\5F0E.tmp"C:\Users\Admin\AppData\Local\Temp\5F0E.tmp"87⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"88⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\6008.tmp"C:\Users\Admin\AppData\Local\Temp\6008.tmp"89⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\6085.tmp"C:\Users\Admin\AppData\Local\Temp\6085.tmp"90⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\6112.tmp"C:\Users\Admin\AppData\Local\Temp\6112.tmp"91⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\619E.tmp"C:\Users\Admin\AppData\Local\Temp\619E.tmp"92⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\622B.tmp"C:\Users\Admin\AppData\Local\Temp\622B.tmp"93⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\6298.tmp"C:\Users\Admin\AppData\Local\Temp\6298.tmp"94⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\6306.tmp"C:\Users\Admin\AppData\Local\Temp\6306.tmp"95⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\6383.tmp"C:\Users\Admin\AppData\Local\Temp\6383.tmp"96⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\640F.tmp"C:\Users\Admin\AppData\Local\Temp\640F.tmp"97⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\647D.tmp"C:\Users\Admin\AppData\Local\Temp\647D.tmp"98⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\64FA.tmp"C:\Users\Admin\AppData\Local\Temp\64FA.tmp"99⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\6586.tmp"C:\Users\Admin\AppData\Local\Temp\6586.tmp"100⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\6603.tmp"C:\Users\Admin\AppData\Local\Temp\6603.tmp"101⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\6690.tmp"C:\Users\Admin\AppData\Local\Temp\6690.tmp"102⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\66FD.tmp"C:\Users\Admin\AppData\Local\Temp\66FD.tmp"103⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\676B.tmp"C:\Users\Admin\AppData\Local\Temp\676B.tmp"104⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"105⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\6874.tmp"C:\Users\Admin\AppData\Local\Temp\6874.tmp"106⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\6901.tmp"C:\Users\Admin\AppData\Local\Temp\6901.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\698E.tmp"C:\Users\Admin\AppData\Local\Temp\698E.tmp"108⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\6A0B.tmp"C:\Users\Admin\AppData\Local\Temp\6A0B.tmp"109⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\6A78.tmp"C:\Users\Admin\AppData\Local\Temp\6A78.tmp"110⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\6B14.tmp"C:\Users\Admin\AppData\Local\Temp\6B14.tmp"111⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\6B91.tmp"C:\Users\Admin\AppData\Local\Temp\6B91.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"113⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\6CBA.tmp"C:\Users\Admin\AppData\Local\Temp\6CBA.tmp"114⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\6D27.tmp"C:\Users\Admin\AppData\Local\Temp\6D27.tmp"115⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"116⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\6E31.tmp"C:\Users\Admin\AppData\Local\Temp\6E31.tmp"117⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"118⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\6F1B.tmp"C:\Users\Admin\AppData\Local\Temp\6F1B.tmp"119⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\6FA8.tmp"C:\Users\Admin\AppData\Local\Temp\6FA8.tmp"120⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\7025.tmp"C:\Users\Admin\AppData\Local\Temp\7025.tmp"121⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\70C1.tmp"C:\Users\Admin\AppData\Local\Temp\70C1.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:6128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-