Analysis
- max time kernel
134s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 15:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_02beda98f7dae47035e1f53a5be95eeb_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_02beda98f7dae47035e1f53a5be95eeb_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-22_02beda98f7dae47035e1f53a5be95eeb_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260722-ten4sagh59
- SHA256 f5760a3a82ed6f731bf6e230eb78f1ab597278642992cf6e6b56475d5ceb0df2
- MD5 02beda98f7dae47035e1f53a5be95eeb
- SHA1 f2ae54f2f96b6b6233a3048a277a6bab32e714ef
- SHA512 9d917ab3892ba202e6799b81e609a8096fed450e1086fc9098522843795e4d2599deeac73b22878c3996e182d354e9f3b43903ddf30e9d0b67a42f5c19d6b3c2
- SSDEEP 12288:wU5rCOTeiDLSLMgWiTCSHJRA9IUvzDkMRKcuk6NZ+3/v+I9hUG2VA:wUQOJD2LMgWfOJ+vzDvQcu1NGEA
- TLSH T1BAE4E02177D8C532E5FB037859B5E6615D7EBD269722D6CF2F8012AE09B1BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 204 554A.tmp 1512 573E.tmp 4920 58A5.tmp 3592 59BF.tmp 1068 5AC8.tmp 2536 5C10.tmp 876 5CDC.tmp 904 5E14.tmp 5768 5F6C.tmp 2388 60B4.tmp 3124 622B.tmp 5516 6392.tmp 1844 646D.tmp 2824 6586.tmp 2336 6671.tmp 5852 677A.tmp 1100 6894.tmp 2224 69BC.tmp 5992 6AE5.tmp 5148 6BEF.tmp 600 6CF9.tmp 4168 6DE3.tmp 4988 6EFC.tmp 720 7035.tmp 2412 715E.tmp 2136 7296.tmp 2836 7390.tmp 2468 74A9.tmp 2940 7594.tmp 3744 76FB.tmp 3820 7814.tmp 5980 790E.tmp 2308 797C.tmp 4276 7A85.tmp 2840 7B60.tmp 840 7C0C.tmp 3228 7CA8.tmp 2200 7D44.tmp 4872 7E00.tmp 5188 7EFA.tmp 3864 7FB5.tmp 4312 80A0.tmp 3120 816B.tmp 1124 8275.tmp 1392 835F.tmp 704 843A.tmp 5804 84C6.tmp 6040 8582.tmp 3904 863D.tmp 4464 86CA.tmp 5000 8747.tmp 4560 87C4.tmp 5496 8831.tmp 4908 88AE.tmp 4932 894B.tmp 3872 89D7.tmp 5460 8A45.tmp 2496 8B00.tmp 5720 8B7D.tmp 2864 8BFA.tmp 1660 8C87.tmp 3432 8D13.tmp 3436 8DA0.tmp 1992 8E1D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1615.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8747.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E773.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2404.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E560.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 224A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E996.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A03E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7035.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E679.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 607.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C819.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 370F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 423.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7168.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8733.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9721.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F81D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B471.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 919.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC9.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4128 wrote to memory of 204 4128 2026-07-22_02beda98f7dae47035e1f53a5be95eeb_elex_mafia_stealc_tofsee.exe 89 PID 204 wrote to memory of 1512 204 554A.tmp 90 PID 1512 wrote to memory of 4920 1512 573E.tmp 91 PID 4920 wrote to memory of 3592 4920 58A5.tmp 92 PID 3592 wrote to memory of 1068 3592 59BF.tmp 93 PID 1068 wrote to memory of 2536 1068 5AC8.tmp 94 PID 2536 wrote to memory of 876 2536 5C10.tmp 95 PID 876 wrote to memory of 904 876 5CDC.tmp 96 PID 904 wrote to memory of 5768 904 5E14.tmp 97 PID 5768 wrote to memory of 2388 5768 5F6C.tmp 98 PID 2388 wrote to memory of 3124 2388 60B4.tmp 99 PID 3124 wrote to memory of 5516 3124 622B.tmp 100 PID 5516 wrote to memory of 1844 5516 6392.tmp 101 PID 1844 wrote to memory of 2824 1844 646D.tmp 102 PID 2824 wrote to memory of 2336 2824 6586.tmp 103 PID 2336 wrote to memory of 5852 2336 6671.tmp 104 PID 5852 wrote to memory of 1100 5852 677A.tmp 105 PID 1100 wrote to memory of 2224 1100 6894.tmp 106 PID 2224 wrote to memory of 5992 2224 69BC.tmp 107 PID 5992 wrote to memory of 5148 5992 6AE5.tmp 108 PID 5148 wrote to memory of 600 5148 6BEF.tmp 109 PID 600 wrote to memory of 4168 600 6CF9.tmp 110 PID 4168 wrote to memory of 4988 4168 6DE3.tmp 111 PID 4988 wrote to memory of 720 4988 6EFC.tmp 112 PID 720 wrote to memory of 2412 720 7035.tmp 113 PID 2412 wrote to memory of 2136 2412 715E.tmp 114 PID 2136 wrote to memory of 2836 2136 7296.tmp 115 PID 2836 wrote to memory of 2468 2836 7390.tmp 116 PID 2468 wrote to memory of 2940 2468 74A9.tmp 117 PID 2940 wrote to memory of 3744 2940 7594.tmp 118 PID 3744 wrote to memory of 3820 3744 76FB.tmp 119 PID 3820 wrote to memory of 5980 3820 7814.tmp 120 PID 5980 wrote to memory of 2308 5980 790E.tmp 121 PID 2308 wrote to memory of 4276 2308 797C.tmp 122 PID 4276 wrote to memory of 2840 4276 7A85.tmp 123 PID 2840 wrote to memory of 840 2840 7B60.tmp 124 PID 840 wrote to memory of 3228 840 7C0C.tmp 125 PID 3228 wrote to memory of 2200 3228 7CA8.tmp 126 PID 2200 wrote to memory of 4872 2200 7D44.tmp 127 PID 4872 wrote to memory of 5188 4872 7E00.tmp 128 PID 5188 wrote to memory of 3864 5188 7EFA.tmp 129 PID 3864 wrote to memory of 4312 3864 7FB5.tmp 130 PID 4312 wrote to memory of 3120 4312 80A0.tmp 131 PID 3120 wrote to memory of 1124 3120 816B.tmp 132 PID 1124 wrote to memory of 1392 1124 8275.tmp 133 PID 1392 wrote to memory of 704 1392 835F.tmp 134 PID 704 wrote to memory of 5804 704 843A.tmp 135 PID 5804 wrote to memory of 6040 5804 84C6.tmp 136 PID 6040 wrote to memory of 3904 6040 8582.tmp 137 PID 3904 wrote to memory of 4464 3904 863D.tmp 138 PID 4464 wrote to memory of 5000 4464 86CA.tmp 139 PID 5000 wrote to memory of 4560 5000 8747.tmp 140 PID 4560 wrote to memory of 5496 4560 87C4.tmp 141 PID 5496 wrote to memory of 4908 5496 8831.tmp 142 PID 4908 wrote to memory of 4932 4908 88AE.tmp 143 PID 4932 wrote to memory of 3872 4932 894B.tmp 144 PID 3872 wrote to memory of 5460 3872 89D7.tmp 145 PID 5460 wrote to memory of 2496 5460 8A45.tmp 146 PID 2496 wrote to memory of 5720 2496 8B00.tmp 147 PID 5720 wrote to memory of 2864 5720 8B7D.tmp 148 PID 2864 wrote to memory of 1660 2864 8BFA.tmp 149 PID 1660 wrote to memory of 3432 1660 8C87.tmp 150 PID 3432 wrote to memory of 3436 3432 8D13.tmp 151 PID 3436 wrote to memory of 1992 3436 8DA0.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_02beda98f7dae47035e1f53a5be95eeb_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_02beda98f7dae47035e1f53a5be95eeb_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\554A.tmp"C:\Users\Admin\AppData\Local\Temp\554A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\573E.tmp"C:\Users\Admin\AppData\Local\Temp\573E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\58A5.tmp"C:\Users\Admin\AppData\Local\Temp\58A5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\59BF.tmp"C:\Users\Admin\AppData\Local\Temp\59BF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\5AC8.tmp"C:\Users\Admin\AppData\Local\Temp\5AC8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\5C10.tmp"C:\Users\Admin\AppData\Local\Temp\5C10.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\5CDC.tmp"C:\Users\Admin\AppData\Local\Temp\5CDC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\5E14.tmp"C:\Users\Admin\AppData\Local\Temp\5E14.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\5F6C.tmp"C:\Users\Admin\AppData\Local\Temp\5F6C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\60B4.tmp"C:\Users\Admin\AppData\Local\Temp\60B4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\622B.tmp"C:\Users\Admin\AppData\Local\Temp\622B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\6392.tmp"C:\Users\Admin\AppData\Local\Temp\6392.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\646D.tmp"C:\Users\Admin\AppData\Local\Temp\646D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\6586.tmp"C:\Users\Admin\AppData\Local\Temp\6586.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\6671.tmp"C:\Users\Admin\AppData\Local\Temp\6671.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\677A.tmp"C:\Users\Admin\AppData\Local\Temp\677A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\6894.tmp"C:\Users\Admin\AppData\Local\Temp\6894.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\69BC.tmp"C:\Users\Admin\AppData\Local\Temp\69BC.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\6AE5.tmp"C:\Users\Admin\AppData\Local\Temp\6AE5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\6BEF.tmp"C:\Users\Admin\AppData\Local\Temp\6BEF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\6CF9.tmp"C:\Users\Admin\AppData\Local\Temp\6CF9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Users\Admin\AppData\Local\Temp\6DE3.tmp"C:\Users\Admin\AppData\Local\Temp\6DE3.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\6EFC.tmp"C:\Users\Admin\AppData\Local\Temp\6EFC.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\7035.tmp"C:\Users\Admin\AppData\Local\Temp\7035.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\715E.tmp"C:\Users\Admin\AppData\Local\Temp\715E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\7296.tmp"C:\Users\Admin\AppData\Local\Temp\7296.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\7390.tmp"C:\Users\Admin\AppData\Local\Temp\7390.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\74A9.tmp"C:\Users\Admin\AppData\Local\Temp\74A9.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\7594.tmp"C:\Users\Admin\AppData\Local\Temp\7594.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\76FB.tmp"C:\Users\Admin\AppData\Local\Temp\76FB.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\7814.tmp"C:\Users\Admin\AppData\Local\Temp\7814.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\790E.tmp"C:\Users\Admin\AppData\Local\Temp\790E.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\797C.tmp"C:\Users\Admin\AppData\Local\Temp\797C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\7A85.tmp"C:\Users\Admin\AppData\Local\Temp\7A85.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\7B60.tmp"C:\Users\Admin\AppData\Local\Temp\7B60.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\7D44.tmp"C:\Users\Admin\AppData\Local\Temp\7D44.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\7E00.tmp"C:\Users\Admin\AppData\Local\Temp\7E00.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\7EFA.tmp"C:\Users\Admin\AppData\Local\Temp\7EFA.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\7FB5.tmp"C:\Users\Admin\AppData\Local\Temp\7FB5.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\80A0.tmp"C:\Users\Admin\AppData\Local\Temp\80A0.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\816B.tmp"C:\Users\Admin\AppData\Local\Temp\816B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\8275.tmp"C:\Users\Admin\AppData\Local\Temp\8275.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\835F.tmp"C:\Users\Admin\AppData\Local\Temp\835F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\843A.tmp"C:\Users\Admin\AppData\Local\Temp\843A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\84C6.tmp"C:\Users\Admin\AppData\Local\Temp\84C6.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\8582.tmp"C:\Users\Admin\AppData\Local\Temp\8582.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\863D.tmp"C:\Users\Admin\AppData\Local\Temp\863D.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\86CA.tmp"C:\Users\Admin\AppData\Local\Temp\86CA.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\8747.tmp"C:\Users\Admin\AppData\Local\Temp\8747.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\87C4.tmp"C:\Users\Admin\AppData\Local\Temp\87C4.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\8831.tmp"C:\Users\Admin\AppData\Local\Temp\8831.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\88AE.tmp"C:\Users\Admin\AppData\Local\Temp\88AE.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\894B.tmp"C:\Users\Admin\AppData\Local\Temp\894B.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\89D7.tmp"C:\Users\Admin\AppData\Local\Temp\89D7.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\8A45.tmp"C:\Users\Admin\AppData\Local\Temp\8A45.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\8B00.tmp"C:\Users\Admin\AppData\Local\Temp\8B00.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\8D13.tmp"C:\Users\Admin\AppData\Local\Temp\8D13.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\8E1D.tmp"C:\Users\Admin\AppData\Local\Temp\8E1D.tmp"65⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\8E9A.tmp"C:\Users\Admin\AppData\Local\Temp\8E9A.tmp"66⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\8F27.tmp"C:\Users\Admin\AppData\Local\Temp\8F27.tmp"67⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\8FB3.tmp"C:\Users\Admin\AppData\Local\Temp\8FB3.tmp"68⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\9021.tmp"C:\Users\Admin\AppData\Local\Temp\9021.tmp"69⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\909E.tmp"C:\Users\Admin\AppData\Local\Temp\909E.tmp"70⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\912A.tmp"C:\Users\Admin\AppData\Local\Temp\912A.tmp"71⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\91B7.tmp"C:\Users\Admin\AppData\Local\Temp\91B7.tmp"72⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\9224.tmp"C:\Users\Admin\AppData\Local\Temp\9224.tmp"73⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\92A1.tmp"C:\Users\Admin\AppData\Local\Temp\92A1.tmp"74⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\930F.tmp"C:\Users\Admin\AppData\Local\Temp\930F.tmp"75⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\93AB.tmp"C:\Users\Admin\AppData\Local\Temp\93AB.tmp"76⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\9428.tmp"C:\Users\Admin\AppData\Local\Temp\9428.tmp"77⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\94A5.tmp"C:\Users\Admin\AppData\Local\Temp\94A5.tmp"78⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\9531.tmp"C:\Users\Admin\AppData\Local\Temp\9531.tmp"79⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\95AE.tmp"C:\Users\Admin\AppData\Local\Temp\95AE.tmp"80⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\963B.tmp"C:\Users\Admin\AppData\Local\Temp\963B.tmp"81⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\96B8.tmp"C:\Users\Admin\AppData\Local\Temp\96B8.tmp"82⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\9735.tmp"C:\Users\Admin\AppData\Local\Temp\9735.tmp"83⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\97A2.tmp"C:\Users\Admin\AppData\Local\Temp\97A2.tmp"84⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\984E.tmp"C:\Users\Admin\AppData\Local\Temp\984E.tmp"85⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\98EB.tmp"C:\Users\Admin\AppData\Local\Temp\98EB.tmp"86⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\99C5.tmp"C:\Users\Admin\AppData\Local\Temp\99C5.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\9A42.tmp"C:\Users\Admin\AppData\Local\Temp\9A42.tmp"88⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\9ACF.tmp"C:\Users\Admin\AppData\Local\Temp\9ACF.tmp"89⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"90⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"C:\Users\Admin\AppData\Local\Temp\9BE8.tmp"91⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\9C75.tmp"C:\Users\Admin\AppData\Local\Temp\9C75.tmp"92⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\9CF2.tmp"C:\Users\Admin\AppData\Local\Temp\9CF2.tmp"93⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\9D7E.tmp"C:\Users\Admin\AppData\Local\Temp\9D7E.tmp"94⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\9DDC.tmp"C:\Users\Admin\AppData\Local\Temp\9DDC.tmp"95⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\9E78.tmp"C:\Users\Admin\AppData\Local\Temp\9E78.tmp"96⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\9F34.tmp"C:\Users\Admin\AppData\Local\Temp\9F34.tmp"97⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"98⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\A03E.tmp"C:\Users\Admin\AppData\Local\Temp\A03E.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\A0BB.tmp"C:\Users\Admin\AppData\Local\Temp\A0BB.tmp"100⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\A138.tmp"C:\Users\Admin\AppData\Local\Temp\A138.tmp"101⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\A1C4.tmp"C:\Users\Admin\AppData\Local\Temp\A1C4.tmp"102⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\A232.tmp"C:\Users\Admin\AppData\Local\Temp\A232.tmp"103⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\A2AF.tmp"C:\Users\Admin\AppData\Local\Temp\A2AF.tmp"104⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\A32C.tmp"C:\Users\Admin\AppData\Local\Temp\A32C.tmp"105⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\A399.tmp"C:\Users\Admin\AppData\Local\Temp\A399.tmp"106⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\A426.tmp"C:\Users\Admin\AppData\Local\Temp\A426.tmp"107⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\A4B2.tmp"C:\Users\Admin\AppData\Local\Temp\A4B2.tmp"108⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\A52F.tmp"C:\Users\Admin\AppData\Local\Temp\A52F.tmp"109⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\A59D.tmp"C:\Users\Admin\AppData\Local\Temp\A59D.tmp"110⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\A61A.tmp"C:\Users\Admin\AppData\Local\Temp\A61A.tmp"111⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\A697.tmp"C:\Users\Admin\AppData\Local\Temp\A697.tmp"112⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\A714.tmp"C:\Users\Admin\AppData\Local\Temp\A714.tmp"113⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\A7A0.tmp"C:\Users\Admin\AppData\Local\Temp\A7A0.tmp"114⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\A81D.tmp"C:\Users\Admin\AppData\Local\Temp\A81D.tmp"115⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\A88B.tmp"C:\Users\Admin\AppData\Local\Temp\A88B.tmp"116⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\A936.tmp"C:\Users\Admin\AppData\Local\Temp\A936.tmp"117⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\A9D3.tmp"C:\Users\Admin\AppData\Local\Temp\A9D3.tmp"118⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\AA50.tmp"C:\Users\Admin\AppData\Local\Temp\AA50.tmp"119⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\AACD.tmp"C:\Users\Admin\AppData\Local\Temp\AACD.tmp"120⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\AB59.tmp"C:\Users\Admin\AppData\Local\Temp\AB59.tmp"121⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\ABD6.tmp"C:\Users\Admin\AppData\Local\Temp\ABD6.tmp"122⤵PID:1248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-