Analysis
- max time kernel
120s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 20:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-24_69cfc47898632bf881c825d7e5968167_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-24_69cfc47898632bf881c825d7e5968167_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-24_69cfc47898632bf881c825d7e5968167_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260724-zqxsysshqa
- SHA256 5d68d799c8cecab1b6230350a645e50b98bb6ce55a3fae002aedbe1b0c88dbfa
- MD5 69cfc47898632bf881c825d7e5968167
- SHA1 073772c4796384a52f3b60063838ae5c3b3d6649
- SHA512 78320d194aa379f69405dcb0bdaa6090c7c1c5001da6cfdbfaa05d9b28f661211821bb0312b24b3cd4c18e4d142dbcf95c576f886c9fe40896c1452abb2b6f28
- SSDEEP 12288:wU5rCOTeiDY8xcfnYGkFTtdmtnltNgVohQNZ+3/v+I9hUG2VA:wUQOJDvcgGkf4tnlQ/NGEA
- TLSH T17BE4D02173D8C532E5FB037859B5E6654D7EBD366722D6CF2B8421AE09B1BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4160 25CE.tmp 3348 266A.tmp 4944 2716.tmp 3712 282F.tmp 1796 28BC.tmp 1952 2929.tmp 472 2ABF.tmp 5912 2C08.tmp 2364 2CD3.tmp 3504 2D9E.tmp 5816 2E88.tmp 244 2F92.tmp 5328 30AB.tmp 5520 3186.tmp 4072 3251.tmp 5536 336A.tmp 4968 3483.tmp 4996 358D.tmp 2368 3668.tmp 2180 3743.tmp 2604 384C.tmp 1972 39A4.tmp 6140 3A7F.tmp 5456 3BB7.tmp 5876 3CC1.tmp 4284 3DF9.tmp 5040 3F03.tmp 5504 400D.tmp 1560 4155.tmp 3268 425E.tmp 3616 4329.tmp 6136 4404.tmp 1172 458B.tmp 1496 4675.tmp 3776 4750.tmp 2692 480B.tmp 3372 48A8.tmp 5604 4973.tmp 4784 4A2E.tmp 2376 4ACB.tmp 2932 4B57.tmp 2032 4C42.tmp 5384 4CFD.tmp 4148 4DE7.tmp 5388 4E93.tmp 1652 4F30.tmp 2540 5039.tmp 4744 5104.tmp 5768 51B0.tmp 2580 524C.tmp 6076 52C9.tmp 1532 5346.tmp 4292 53C3.tmp 5344 5450.tmp 1688 54EC.tmp 5136 5569.tmp 6008 55F6.tmp 5744 5663.tmp 2044 56F0.tmp 3224 577D.tmp 3212 5819.tmp 2504 58A5.tmp 3544 5951.tmp 1288 59CE.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F052.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7929.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 324C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 838E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D93F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B73B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 620C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1203.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9754.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4008.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 541C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6623.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 372E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AACD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F35F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4131.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4675.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D72C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2126.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 445D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 129F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63CC.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5064 wrote to memory of 4160 5064 2026-07-24_69cfc47898632bf881c825d7e5968167_elex_mafia_stealc_tofsee.exe 89 PID 4160 wrote to memory of 3348 4160 25CE.tmp 90 PID 3348 wrote to memory of 4944 3348 266A.tmp 91 PID 4944 wrote to memory of 3712 4944 2716.tmp 92 PID 3712 wrote to memory of 1796 3712 282F.tmp 93 PID 1796 wrote to memory of 1952 1796 28BC.tmp 94 PID 1952 wrote to memory of 472 1952 2929.tmp 95 PID 472 wrote to memory of 5912 472 2ABF.tmp 96 PID 5912 wrote to memory of 2364 5912 2C08.tmp 97 PID 2364 wrote to memory of 3504 2364 2CD3.tmp 98 PID 3504 wrote to memory of 5816 3504 2D9E.tmp 99 PID 5816 wrote to memory of 244 5816 2E88.tmp 100 PID 244 wrote to memory of 5328 244 2F92.tmp 101 PID 5328 wrote to memory of 5520 5328 30AB.tmp 102 PID 5520 wrote to memory of 4072 5520 3186.tmp 103 PID 4072 wrote to memory of 5536 4072 3251.tmp 104 PID 5536 wrote to memory of 4968 5536 336A.tmp 105 PID 4968 wrote to memory of 4996 4968 3483.tmp 106 PID 4996 wrote to memory of 2368 4996 358D.tmp 107 PID 2368 wrote to memory of 2180 2368 3668.tmp 108 PID 2180 wrote to memory of 2604 2180 3743.tmp 109 PID 2604 wrote to memory of 1972 2604 384C.tmp 110 PID 1972 wrote to memory of 6140 1972 39A4.tmp 111 PID 6140 wrote to memory of 5456 6140 3A7F.tmp 112 PID 5456 wrote to memory of 5876 5456 3BB7.tmp 113 PID 5876 wrote to memory of 4284 5876 3CC1.tmp 114 PID 4284 wrote to memory of 5040 4284 3DF9.tmp 115 PID 5040 wrote to memory of 5504 5040 3F03.tmp 116 PID 5504 wrote to memory of 1560 5504 400D.tmp 117 PID 1560 wrote to memory of 3268 1560 4155.tmp 118 PID 3268 wrote to memory of 3616 3268 425E.tmp 119 PID 3616 wrote to memory of 6136 3616 4329.tmp 120 PID 6136 wrote to memory of 1172 6136 4404.tmp 121 PID 1172 wrote to memory of 1496 1172 458B.tmp 122 PID 1496 wrote to memory of 3776 1496 4675.tmp 123 PID 3776 wrote to memory of 2692 3776 4750.tmp 124 PID 2692 wrote to memory of 3372 2692 480B.tmp 125 PID 3372 wrote to memory of 5604 3372 48A8.tmp 126 PID 5604 wrote to memory of 4784 5604 4973.tmp 127 PID 4784 wrote to memory of 2376 4784 4A2E.tmp 128 PID 2376 wrote to memory of 2932 2376 4ACB.tmp 129 PID 2932 wrote to memory of 2032 2932 4B57.tmp 130 PID 2032 wrote to memory of 5384 2032 4C42.tmp 131 PID 5384 wrote to memory of 4148 5384 4CFD.tmp 132 PID 4148 wrote to memory of 5388 4148 4DE7.tmp 133 PID 5388 wrote to memory of 1652 5388 4E93.tmp 134 PID 1652 wrote to memory of 2540 1652 4F30.tmp 135 PID 2540 wrote to memory of 4744 2540 5039.tmp 136 PID 4744 wrote to memory of 5768 4744 5104.tmp 137 PID 5768 wrote to memory of 2580 5768 51B0.tmp 138 PID 2580 wrote to memory of 6076 2580 524C.tmp 139 PID 6076 wrote to memory of 1532 6076 52C9.tmp 140 PID 1532 wrote to memory of 4292 1532 5346.tmp 141 PID 4292 wrote to memory of 5344 4292 53C3.tmp 142 PID 5344 wrote to memory of 1688 5344 5450.tmp 143 PID 1688 wrote to memory of 5136 1688 54EC.tmp 144 PID 5136 wrote to memory of 6008 5136 5569.tmp 145 PID 6008 wrote to memory of 5744 6008 55F6.tmp 146 PID 5744 wrote to memory of 2044 5744 5663.tmp 147 PID 2044 wrote to memory of 3224 2044 56F0.tmp 148 PID 3224 wrote to memory of 3212 3224 577D.tmp 149 PID 3212 wrote to memory of 2504 3212 5819.tmp 150 PID 2504 wrote to memory of 3544 2504 58A5.tmp 151 PID 3544 wrote to memory of 1288 3544 5951.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-24_69cfc47898632bf881c825d7e5968167_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-24_69cfc47898632bf881c825d7e5968167_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\25CE.tmp"C:\Users\Admin\AppData\Local\Temp\25CE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\266A.tmp"C:\Users\Admin\AppData\Local\Temp\266A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\2716.tmp"C:\Users\Admin\AppData\Local\Temp\2716.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\282F.tmp"C:\Users\Admin\AppData\Local\Temp\282F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\28BC.tmp"C:\Users\Admin\AppData\Local\Temp\28BC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\2929.tmp"C:\Users\Admin\AppData\Local\Temp\2929.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\2ABF.tmp"C:\Users\Admin\AppData\Local\Temp\2ABF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\2C08.tmp"C:\Users\Admin\AppData\Local\Temp\2C08.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"C:\Users\Admin\AppData\Local\Temp\2CD3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\2D9E.tmp"C:\Users\Admin\AppData\Local\Temp\2D9E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\2E88.tmp"C:\Users\Admin\AppData\Local\Temp\2E88.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\2F92.tmp"C:\Users\Admin\AppData\Local\Temp\2F92.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\30AB.tmp"C:\Users\Admin\AppData\Local\Temp\30AB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\3186.tmp"C:\Users\Admin\AppData\Local\Temp\3186.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\3251.tmp"C:\Users\Admin\AppData\Local\Temp\3251.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\336A.tmp"C:\Users\Admin\AppData\Local\Temp\336A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\3483.tmp"C:\Users\Admin\AppData\Local\Temp\3483.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\358D.tmp"C:\Users\Admin\AppData\Local\Temp\358D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\3668.tmp"C:\Users\Admin\AppData\Local\Temp\3668.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\3743.tmp"C:\Users\Admin\AppData\Local\Temp\3743.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\384C.tmp"C:\Users\Admin\AppData\Local\Temp\384C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\39A4.tmp"C:\Users\Admin\AppData\Local\Temp\39A4.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3A7F.tmp"C:\Users\Admin\AppData\Local\Temp\3A7F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\3BB7.tmp"C:\Users\Admin\AppData\Local\Temp\3BB7.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\3CC1.tmp"C:\Users\Admin\AppData\Local\Temp\3CC1.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\400D.tmp"C:\Users\Admin\AppData\Local\Temp\400D.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\4155.tmp"C:\Users\Admin\AppData\Local\Temp\4155.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\425E.tmp"C:\Users\Admin\AppData\Local\Temp\425E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\4329.tmp"C:\Users\Admin\AppData\Local\Temp\4329.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\4404.tmp"C:\Users\Admin\AppData\Local\Temp\4404.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\458B.tmp"C:\Users\Admin\AppData\Local\Temp\458B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\4675.tmp"C:\Users\Admin\AppData\Local\Temp\4675.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\4750.tmp"C:\Users\Admin\AppData\Local\Temp\4750.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\480B.tmp"C:\Users\Admin\AppData\Local\Temp\480B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\48A8.tmp"C:\Users\Admin\AppData\Local\Temp\48A8.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\4973.tmp"C:\Users\Admin\AppData\Local\Temp\4973.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\4A2E.tmp"C:\Users\Admin\AppData\Local\Temp\4A2E.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\4ACB.tmp"C:\Users\Admin\AppData\Local\Temp\4ACB.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\4B57.tmp"C:\Users\Admin\AppData\Local\Temp\4B57.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\4C42.tmp"C:\Users\Admin\AppData\Local\Temp\4C42.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\4DE7.tmp"C:\Users\Admin\AppData\Local\Temp\4DE7.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\4E93.tmp"C:\Users\Admin\AppData\Local\Temp\4E93.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\4F30.tmp"C:\Users\Admin\AppData\Local\Temp\4F30.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\5039.tmp"C:\Users\Admin\AppData\Local\Temp\5039.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\5104.tmp"C:\Users\Admin\AppData\Local\Temp\5104.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\51B0.tmp"C:\Users\Admin\AppData\Local\Temp\51B0.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\524C.tmp"C:\Users\Admin\AppData\Local\Temp\524C.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\52C9.tmp"C:\Users\Admin\AppData\Local\Temp\52C9.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\5346.tmp"C:\Users\Admin\AppData\Local\Temp\5346.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\53C3.tmp"C:\Users\Admin\AppData\Local\Temp\53C3.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\5450.tmp"C:\Users\Admin\AppData\Local\Temp\5450.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\54EC.tmp"C:\Users\Admin\AppData\Local\Temp\54EC.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\5569.tmp"C:\Users\Admin\AppData\Local\Temp\5569.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5136 -
C:\Users\Admin\AppData\Local\Temp\55F6.tmp"C:\Users\Admin\AppData\Local\Temp\55F6.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\5663.tmp"C:\Users\Admin\AppData\Local\Temp\5663.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\56F0.tmp"C:\Users\Admin\AppData\Local\Temp\56F0.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\577D.tmp"C:\Users\Admin\AppData\Local\Temp\577D.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\5819.tmp"C:\Users\Admin\AppData\Local\Temp\5819.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\58A5.tmp"C:\Users\Admin\AppData\Local\Temp\58A5.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\5951.tmp"C:\Users\Admin\AppData\Local\Temp\5951.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\59CE.tmp"C:\Users\Admin\AppData\Local\Temp\59CE.tmp"65⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\5A3C.tmp"C:\Users\Admin\AppData\Local\Temp\5A3C.tmp"66⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\5AC8.tmp"C:\Users\Admin\AppData\Local\Temp\5AC8.tmp"67⤵PID:5492
-
C:\Users\Admin\AppData\Local\Temp\5B55.tmp"C:\Users\Admin\AppData\Local\Temp\5B55.tmp"68⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\5BE2.tmp"C:\Users\Admin\AppData\Local\Temp\5BE2.tmp"69⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\5C6E.tmp"C:\Users\Admin\AppData\Local\Temp\5C6E.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\5D0A.tmp"C:\Users\Admin\AppData\Local\Temp\5D0A.tmp"71⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\5D87.tmp"C:\Users\Admin\AppData\Local\Temp\5D87.tmp"72⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\5E24.tmp"C:\Users\Admin\AppData\Local\Temp\5E24.tmp"73⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\5EB0.tmp"C:\Users\Admin\AppData\Local\Temp\5EB0.tmp"74⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\5F5C.tmp"C:\Users\Admin\AppData\Local\Temp\5F5C.tmp"75⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\5FD9.tmp"C:\Users\Admin\AppData\Local\Temp\5FD9.tmp"76⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\6056.tmp"C:\Users\Admin\AppData\Local\Temp\6056.tmp"77⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\60D3.tmp"C:\Users\Admin\AppData\Local\Temp\60D3.tmp"78⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\616F.tmp"C:\Users\Admin\AppData\Local\Temp\616F.tmp"79⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\620C.tmp"C:\Users\Admin\AppData\Local\Temp\620C.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\6289.tmp"C:\Users\Admin\AppData\Local\Temp\6289.tmp"81⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\6306.tmp"C:\Users\Admin\AppData\Local\Temp\6306.tmp"82⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\6392.tmp"C:\Users\Admin\AppData\Local\Temp\6392.tmp"83⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\640F.tmp"C:\Users\Admin\AppData\Local\Temp\640F.tmp"84⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\648C.tmp"C:\Users\Admin\AppData\Local\Temp\648C.tmp"85⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\6519.tmp"C:\Users\Admin\AppData\Local\Temp\6519.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\65A6.tmp"C:\Users\Admin\AppData\Local\Temp\65A6.tmp"87⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\6623.tmp"C:\Users\Admin\AppData\Local\Temp\6623.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\66AF.tmp"C:\Users\Admin\AppData\Local\Temp\66AF.tmp"89⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\672C.tmp"C:\Users\Admin\AppData\Local\Temp\672C.tmp"90⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\67B9.tmp"C:\Users\Admin\AppData\Local\Temp\67B9.tmp"91⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\6855.tmp"C:\Users\Admin\AppData\Local\Temp\6855.tmp"92⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\68D2.tmp"C:\Users\Admin\AppData\Local\Temp\68D2.tmp"93⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\697E.tmp"C:\Users\Admin\AppData\Local\Temp\697E.tmp"94⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\69EB.tmp"C:\Users\Admin\AppData\Local\Temp\69EB.tmp"95⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\6AA7.tmp"C:\Users\Admin\AppData\Local\Temp\6AA7.tmp"96⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\6B24.tmp"C:\Users\Admin\AppData\Local\Temp\6B24.tmp"97⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\6BB0.tmp"C:\Users\Admin\AppData\Local\Temp\6BB0.tmp"98⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\6C2D.tmp"C:\Users\Admin\AppData\Local\Temp\6C2D.tmp"99⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\6CE9.tmp"C:\Users\Admin\AppData\Local\Temp\6CE9.tmp"100⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\6D66.tmp"C:\Users\Admin\AppData\Local\Temp\6D66.tmp"101⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"102⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"103⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\6F2B.tmp"C:\Users\Admin\AppData\Local\Temp\6F2B.tmp"104⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\6FC7.tmp"C:\Users\Admin\AppData\Local\Temp\6FC7.tmp"105⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\7054.tmp"C:\Users\Admin\AppData\Local\Temp\7054.tmp"106⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\70D1.tmp"C:\Users\Admin\AppData\Local\Temp\70D1.tmp"107⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\716D.tmp"C:\Users\Admin\AppData\Local\Temp\716D.tmp"108⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\71FA.tmp"C:\Users\Admin\AppData\Local\Temp\71FA.tmp"109⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\7286.tmp"C:\Users\Admin\AppData\Local\Temp\7286.tmp"110⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\7313.tmp"C:\Users\Admin\AppData\Local\Temp\7313.tmp"111⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\73A0.tmp"C:\Users\Admin\AppData\Local\Temp\73A0.tmp"112⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\741D.tmp"C:\Users\Admin\AppData\Local\Temp\741D.tmp"113⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\749A.tmp"C:\Users\Admin\AppData\Local\Temp\749A.tmp"114⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\7517.tmp"C:\Users\Admin\AppData\Local\Temp\7517.tmp"115⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\75B3.tmp"C:\Users\Admin\AppData\Local\Temp\75B3.tmp"116⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\764F.tmp"C:\Users\Admin\AppData\Local\Temp\764F.tmp"117⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\76CC.tmp"C:\Users\Admin\AppData\Local\Temp\76CC.tmp"118⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\7749.tmp"C:\Users\Admin\AppData\Local\Temp\7749.tmp"119⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\77F5.tmp"C:\Users\Admin\AppData\Local\Temp\77F5.tmp"120⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\7862.tmp"C:\Users\Admin\AppData\Local\Temp\7862.tmp"121⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\78EF.tmp"C:\Users\Admin\AppData\Local\Temp\78EF.tmp"122⤵PID:692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-