Analysis
- max time kernel
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 04:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_0ec0e871c0cbc1bce2841525ea2aaf0f_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_0ec0e871c0cbc1bce2841525ea2aaf0f_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-22_0ec0e871c0cbc1bce2841525ea2aaf0f_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260722-e157vsvygy
- SHA256 d1d86a953b199df7c28f5ad2e9f9152e0dd72f94c7b87f5e6edb99187a63bd90
- MD5 0ec0e871c0cbc1bce2841525ea2aaf0f
- SHA1 b56129772aca4b721d80ae3808a7c4b8fc8e31b9
- SHA512 2ad4626c47944b94dd60d20d74bc1468d9b038c958cabd73ab091ba9967773b4ad5e5039315f6f383aefdc90cf9e9b4e84abbdd8cbe6c8255de97e69c169f641
- SSDEEP 12288:wU5rCOTeiDTLbqh/s+hvq/ssEoMRAuNZ+3/v+I9hUG2VA:wUQOJDTam+hW0oM6uNGEA
- TLSH T1CCE4D12173D88532E5FB077859B5E7614D7EBD226722D6CF2F8022AE49B1BC09931723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4612 3714.tmp 3360 382D.tmp 2648 39A4.tmp 4952 3AAE.tmp 4936 3C73.tmp 5820 3DDA.tmp 5380 3F13.tmp 5780 404B.tmp 2564 4126.tmp 5852 422F.tmp 1592 431A.tmp 5548 4462.tmp 3168 455C.tmp 112 4694.tmp 2024 477F.tmp 1984 48B7.tmp 5236 49A2.tmp 2700 4A9C.tmp 4752 4BF3.tmp 5836 4D0D.tmp 2392 4E07.tmp 1832 4F6E.tmp 4120 5078.tmp 4520 5181.tmp 1468 52C9.tmp 5268 5402.tmp 4576 554A.tmp 1968 5673.tmp 2056 57CB.tmp 1368 58C5.tmp 5584 59DE.tmp 4864 5B55.tmp 2864 5C8D.tmp 1216 5D39.tmp 4192 5DF5.tmp 1040 5E91.tmp 3732 5F7B.tmp 5340 6047.tmp 2180 6121.tmp 2444 61FC.tmp 4260 62E6.tmp 6084 63E0.tmp 2528 649C.tmp 2840 6577.tmp 3880 6642.tmp 3936 66CE.tmp 2972 677A.tmp 5580 6855.tmp 2676 68E2.tmp 4360 696E.tmp 2868 69FB.tmp 5592 6A88.tmp 5916 6B33.tmp 2856 6BC0.tmp 1252 6C3D.tmp 6088 6CCA.tmp 4908 6D56.tmp 5384 6DE3.tmp 2640 6E60.tmp 1684 6F1B.tmp 1220 6F98.tmp 4432 7025.tmp 4336 70A2.tmp 8 713E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 439D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1346.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C79C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 863D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 964B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C848.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2627.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 325C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C881.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3714.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C663.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D874.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AADC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5286.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 887F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F330.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5313.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 731E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3322.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B9E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2852 wrote to memory of 4612 2852 2026-07-22_0ec0e871c0cbc1bce2841525ea2aaf0f_elex_mafia_stealc_tofsee.exe 89 PID 4612 wrote to memory of 3360 4612 3714.tmp 90 PID 3360 wrote to memory of 2648 3360 382D.tmp 91 PID 2648 wrote to memory of 4952 2648 39A4.tmp 92 PID 4952 wrote to memory of 4936 4952 3AAE.tmp 93 PID 4936 wrote to memory of 5820 4936 3C73.tmp 94 PID 5820 wrote to memory of 5380 5820 3DDA.tmp 95 PID 5380 wrote to memory of 5780 5380 3F13.tmp 96 PID 5780 wrote to memory of 2564 5780 404B.tmp 97 PID 2564 wrote to memory of 5852 2564 4126.tmp 98 PID 5852 wrote to memory of 1592 5852 422F.tmp 99 PID 1592 wrote to memory of 5548 1592 431A.tmp 100 PID 5548 wrote to memory of 3168 5548 4462.tmp 101 PID 3168 wrote to memory of 112 3168 455C.tmp 102 PID 112 wrote to memory of 2024 112 4694.tmp 103 PID 2024 wrote to memory of 1984 2024 477F.tmp 104 PID 1984 wrote to memory of 5236 1984 48B7.tmp 105 PID 5236 wrote to memory of 2700 5236 49A2.tmp 106 PID 2700 wrote to memory of 4752 2700 4A9C.tmp 107 PID 4752 wrote to memory of 5836 4752 4BF3.tmp 108 PID 5836 wrote to memory of 2392 5836 4D0D.tmp 109 PID 2392 wrote to memory of 1832 2392 4E07.tmp 110 PID 1832 wrote to memory of 4120 1832 4F6E.tmp 111 PID 4120 wrote to memory of 4520 4120 5078.tmp 112 PID 4520 wrote to memory of 1468 4520 5181.tmp 113 PID 1468 wrote to memory of 5268 1468 52C9.tmp 114 PID 5268 wrote to memory of 4576 5268 5402.tmp 115 PID 4576 wrote to memory of 1968 4576 554A.tmp 116 PID 1968 wrote to memory of 2056 1968 5673.tmp 117 PID 2056 wrote to memory of 1368 2056 57CB.tmp 118 PID 1368 wrote to memory of 5584 1368 58C5.tmp 119 PID 5584 wrote to memory of 4864 5584 59DE.tmp 120 PID 4864 wrote to memory of 2864 4864 5B55.tmp 121 PID 2864 wrote to memory of 1216 2864 5C8D.tmp 122 PID 1216 wrote to memory of 4192 1216 5D39.tmp 123 PID 4192 wrote to memory of 1040 4192 5DF5.tmp 124 PID 1040 wrote to memory of 3732 1040 5E91.tmp 125 PID 3732 wrote to memory of 5340 3732 5F7B.tmp 126 PID 5340 wrote to memory of 2180 5340 6047.tmp 127 PID 2180 wrote to memory of 2444 2180 6121.tmp 128 PID 2444 wrote to memory of 4260 2444 61FC.tmp 129 PID 4260 wrote to memory of 6084 4260 62E6.tmp 130 PID 6084 wrote to memory of 2528 6084 63E0.tmp 131 PID 2528 wrote to memory of 2840 2528 649C.tmp 132 PID 2840 wrote to memory of 3880 2840 6577.tmp 133 PID 3880 wrote to memory of 3936 3880 6642.tmp 134 PID 3936 wrote to memory of 2972 3936 66CE.tmp 135 PID 2972 wrote to memory of 5580 2972 677A.tmp 136 PID 5580 wrote to memory of 2676 5580 6855.tmp 137 PID 2676 wrote to memory of 4360 2676 68E2.tmp 138 PID 4360 wrote to memory of 2868 4360 696E.tmp 139 PID 2868 wrote to memory of 5592 2868 69FB.tmp 140 PID 5592 wrote to memory of 5916 5592 6A88.tmp 141 PID 5916 wrote to memory of 2856 5916 6B33.tmp 142 PID 2856 wrote to memory of 1252 2856 6BC0.tmp 143 PID 1252 wrote to memory of 6088 1252 6C3D.tmp 144 PID 6088 wrote to memory of 4908 6088 6CCA.tmp 145 PID 4908 wrote to memory of 5384 4908 6D56.tmp 146 PID 5384 wrote to memory of 2640 5384 6DE3.tmp 147 PID 2640 wrote to memory of 1684 2640 6E60.tmp 148 PID 1684 wrote to memory of 1220 1684 6F1B.tmp 149 PID 1220 wrote to memory of 4432 1220 6F98.tmp 150 PID 4432 wrote to memory of 4336 4432 7025.tmp 151 PID 4336 wrote to memory of 8 4336 70A2.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_0ec0e871c0cbc1bce2841525ea2aaf0f_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_0ec0e871c0cbc1bce2841525ea2aaf0f_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\3714.tmp"C:\Users\Admin\AppData\Local\Temp\3714.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\382D.tmp"C:\Users\Admin\AppData\Local\Temp\382D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\39A4.tmp"C:\Users\Admin\AppData\Local\Temp\39A4.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\3C73.tmp"C:\Users\Admin\AppData\Local\Temp\3C73.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\3DDA.tmp"C:\Users\Admin\AppData\Local\Temp\3DDA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\4126.tmp"C:\Users\Admin\AppData\Local\Temp\4126.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\422F.tmp"C:\Users\Admin\AppData\Local\Temp\422F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\431A.tmp"C:\Users\Admin\AppData\Local\Temp\431A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\4462.tmp"C:\Users\Admin\AppData\Local\Temp\4462.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\455C.tmp"C:\Users\Admin\AppData\Local\Temp\455C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\4694.tmp"C:\Users\Admin\AppData\Local\Temp\4694.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\477F.tmp"C:\Users\Admin\AppData\Local\Temp\477F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\48B7.tmp"C:\Users\Admin\AppData\Local\Temp\48B7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\49A2.tmp"C:\Users\Admin\AppData\Local\Temp\49A2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\4A9C.tmp"C:\Users\Admin\AppData\Local\Temp\4A9C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\4BF3.tmp"C:\Users\Admin\AppData\Local\Temp\4BF3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\4D0D.tmp"C:\Users\Admin\AppData\Local\Temp\4D0D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\4E07.tmp"C:\Users\Admin\AppData\Local\Temp\4E07.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\4F6E.tmp"C:\Users\Admin\AppData\Local\Temp\4F6E.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\5078.tmp"C:\Users\Admin\AppData\Local\Temp\5078.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\5181.tmp"C:\Users\Admin\AppData\Local\Temp\5181.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\52C9.tmp"C:\Users\Admin\AppData\Local\Temp\52C9.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\5402.tmp"C:\Users\Admin\AppData\Local\Temp\5402.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\554A.tmp"C:\Users\Admin\AppData\Local\Temp\554A.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\5673.tmp"C:\Users\Admin\AppData\Local\Temp\5673.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\57CB.tmp"C:\Users\Admin\AppData\Local\Temp\57CB.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\58C5.tmp"C:\Users\Admin\AppData\Local\Temp\58C5.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\59DE.tmp"C:\Users\Admin\AppData\Local\Temp\59DE.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\5B55.tmp"C:\Users\Admin\AppData\Local\Temp\5B55.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\5C8D.tmp"C:\Users\Admin\AppData\Local\Temp\5C8D.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\5D39.tmp"C:\Users\Admin\AppData\Local\Temp\5D39.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\5DF5.tmp"C:\Users\Admin\AppData\Local\Temp\5DF5.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\5E91.tmp"C:\Users\Admin\AppData\Local\Temp\5E91.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\6047.tmp"C:\Users\Admin\AppData\Local\Temp\6047.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\6121.tmp"C:\Users\Admin\AppData\Local\Temp\6121.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\61FC.tmp"C:\Users\Admin\AppData\Local\Temp\61FC.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\62E6.tmp"C:\Users\Admin\AppData\Local\Temp\62E6.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\63E0.tmp"C:\Users\Admin\AppData\Local\Temp\63E0.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\649C.tmp"C:\Users\Admin\AppData\Local\Temp\649C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\6577.tmp"C:\Users\Admin\AppData\Local\Temp\6577.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\66CE.tmp"C:\Users\Admin\AppData\Local\Temp\66CE.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\677A.tmp"C:\Users\Admin\AppData\Local\Temp\677A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\6855.tmp"C:\Users\Admin\AppData\Local\Temp\6855.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\68E2.tmp"C:\Users\Admin\AppData\Local\Temp\68E2.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\696E.tmp"C:\Users\Admin\AppData\Local\Temp\696E.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\69FB.tmp"C:\Users\Admin\AppData\Local\Temp\69FB.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\6A88.tmp"C:\Users\Admin\AppData\Local\Temp\6A88.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\6B33.tmp"C:\Users\Admin\AppData\Local\Temp\6B33.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\6BC0.tmp"C:\Users\Admin\AppData\Local\Temp\6BC0.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\6CCA.tmp"C:\Users\Admin\AppData\Local\Temp\6CCA.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\6D56.tmp"C:\Users\Admin\AppData\Local\Temp\6D56.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\6DE3.tmp"C:\Users\Admin\AppData\Local\Temp\6DE3.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\6E60.tmp"C:\Users\Admin\AppData\Local\Temp\6E60.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\6F1B.tmp"C:\Users\Admin\AppData\Local\Temp\6F1B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\6F98.tmp"C:\Users\Admin\AppData\Local\Temp\6F98.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\7025.tmp"C:\Users\Admin\AppData\Local\Temp\7025.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\70A2.tmp"C:\Users\Admin\AppData\Local\Temp\70A2.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\713E.tmp"C:\Users\Admin\AppData\Local\Temp\713E.tmp"65⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\71DB.tmp"C:\Users\Admin\AppData\Local\Temp\71DB.tmp"66⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\7286.tmp"C:\Users\Admin\AppData\Local\Temp\7286.tmp"67⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\7303.tmp"C:\Users\Admin\AppData\Local\Temp\7303.tmp"68⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\73A0.tmp"C:\Users\Admin\AppData\Local\Temp\73A0.tmp"69⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\744C.tmp"C:\Users\Admin\AppData\Local\Temp\744C.tmp"70⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\74D8.tmp"C:\Users\Admin\AppData\Local\Temp\74D8.tmp"71⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\7574.tmp"C:\Users\Admin\AppData\Local\Temp\7574.tmp"72⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\7620.tmp"C:\Users\Admin\AppData\Local\Temp\7620.tmp"73⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\76AD.tmp"C:\Users\Admin\AppData\Local\Temp\76AD.tmp"74⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\7749.tmp"C:\Users\Admin\AppData\Local\Temp\7749.tmp"75⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\77E5.tmp"C:\Users\Admin\AppData\Local\Temp\77E5.tmp"76⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\7862.tmp"C:\Users\Admin\AppData\Local\Temp\7862.tmp"77⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\78EF.tmp"C:\Users\Admin\AppData\Local\Temp\78EF.tmp"78⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\796C.tmp"C:\Users\Admin\AppData\Local\Temp\796C.tmp"79⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\7A08.tmp"C:\Users\Admin\AppData\Local\Temp\7A08.tmp"80⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\7AA5.tmp"C:\Users\Admin\AppData\Local\Temp\7AA5.tmp"81⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\7B31.tmp"C:\Users\Admin\AppData\Local\Temp\7B31.tmp"82⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\7BBE.tmp"C:\Users\Admin\AppData\Local\Temp\7BBE.tmp"83⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\7C4A.tmp"C:\Users\Admin\AppData\Local\Temp\7C4A.tmp"84⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\7CE7.tmp"C:\Users\Admin\AppData\Local\Temp\7CE7.tmp"85⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\7D64.tmp"C:\Users\Admin\AppData\Local\Temp\7D64.tmp"86⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"87⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"88⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\7F19.tmp"C:\Users\Admin\AppData\Local\Temp\7F19.tmp"89⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\7FA6.tmp"C:\Users\Admin\AppData\Local\Temp\7FA6.tmp"90⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\8023.tmp"C:\Users\Admin\AppData\Local\Temp\8023.tmp"91⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\80AF.tmp"C:\Users\Admin\AppData\Local\Temp\80AF.tmp"92⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\813C.tmp"C:\Users\Admin\AppData\Local\Temp\813C.tmp"93⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\81E8.tmp"C:\Users\Admin\AppData\Local\Temp\81E8.tmp"94⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\8284.tmp"C:\Users\Admin\AppData\Local\Temp\8284.tmp"95⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\8311.tmp"C:\Users\Admin\AppData\Local\Temp\8311.tmp"96⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\839D.tmp"C:\Users\Admin\AppData\Local\Temp\839D.tmp"97⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\842A.tmp"C:\Users\Admin\AppData\Local\Temp\842A.tmp"98⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\84C6.tmp"C:\Users\Admin\AppData\Local\Temp\84C6.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\8543.tmp"C:\Users\Admin\AppData\Local\Temp\8543.tmp"100⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\85C0.tmp"C:\Users\Admin\AppData\Local\Temp\85C0.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\863D.tmp"C:\Users\Admin\AppData\Local\Temp\863D.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\86CA.tmp"C:\Users\Admin\AppData\Local\Temp\86CA.tmp"103⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\8757.tmp"C:\Users\Admin\AppData\Local\Temp\8757.tmp"104⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\87F3.tmp"C:\Users\Admin\AppData\Local\Temp\87F3.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:832 -
C:\Users\Admin\AppData\Local\Temp\887F.tmp"C:\Users\Admin\AppData\Local\Temp\887F.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\891C.tmp"C:\Users\Admin\AppData\Local\Temp\891C.tmp"107⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\89B8.tmp"C:\Users\Admin\AppData\Local\Temp\89B8.tmp"108⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\8A35.tmp"C:\Users\Admin\AppData\Local\Temp\8A35.tmp"109⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"110⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\8C19.tmp"C:\Users\Admin\AppData\Local\Temp\8C19.tmp"112⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"113⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\8D33.tmp"C:\Users\Admin\AppData\Local\Temp\8D33.tmp"114⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"115⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"116⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\8EE8.tmp"C:\Users\Admin\AppData\Local\Temp\8EE8.tmp"117⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\8F75.tmp"C:\Users\Admin\AppData\Local\Temp\8F75.tmp"118⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\9021.tmp"C:\Users\Admin\AppData\Local\Temp\9021.tmp"119⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\90AD.tmp"C:\Users\Admin\AppData\Local\Temp\90AD.tmp"120⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\912A.tmp"C:\Users\Admin\AppData\Local\Temp\912A.tmp"121⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\91C6.tmp"C:\Users\Admin\AppData\Local\Temp\91C6.tmp"122⤵PID:5784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-