Analysis
- max time kernel
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 10:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-27_d21ccb2007cb255dbbeeee72be711c31_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_d21ccb2007cb255dbbeeee72be711c31_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-27_d21ccb2007cb255dbbeeee72be711c31_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260727-l5vp9acq21
- SHA256 b060673dfcca2aace53ad9ac469dee73a4da7fd8054479234a65e5a0cc709039
- MD5 d21ccb2007cb255dbbeeee72be711c31
- SHA1 5043919d675aab7a67c3995f36328b4a92ade73a
- SHA512 10a390b321d20f8b9b5e9232f66adde5a19e2e6ea7aac7a2bc88724c0331c2e48ad2a5a71e7978fe7157f67629f4b3be5fa7b9032d871f7b32e945329c19f472
- SSDEEP 12288:wU5rCOTeiDUqHPjasYPxatAGZNZ+3/v+I9hUG2VA:wUQOJDUqH7FSxatFNGEA
- TLSH T112E4D02173D88536E5FB037C59B5E6614D7EBD22AB22D6DF1F8016AE09B1BC08631723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3324 41DD.tmp 4584 4305.tmp 5828 448C.tmp 124 45A5.tmp 4536 4613.tmp 2376 4855.tmp 5892 4901.tmp 3364 4A2A.tmp 5220 4B43.tmp 5228 4C2D.tmp 2300 4D66.tmp 4964 4EFC.tmp 5408 4FF6.tmp 3288 513E.tmp 4452 5286.tmp 696 5351.tmp 6028 546B.tmp 920 5565.tmp 3976 567E.tmp 5556 5797.tmp 3232 58A1.tmp 5740 59AA.tmp 4556 5B02.tmp 2008 5C1B.tmp 2524 5D44.tmp 2296 5E9C.tmp 1992 5FC5.tmp 1120 60DE.tmp 3924 61A9.tmp 3276 62A3.tmp 4660 63DC.tmp 6004 64E5.tmp 3172 661E.tmp 1312 6708.tmp 4116 67B4.tmp 4604 687F.tmp 2864 6989.tmp 2404 6A54.tmp 4192 6F17.tmp 4424 6FF1.tmp 4888 70CC.tmp 4304 71C6.tmp 4936 7282.tmp 2336 733D.tmp 2900 7408.tmp 2892 74B4.tmp 2876 7550.tmp 4956 75ED.tmp 968 7679.tmp 5548 76F6.tmp 1564 7773.tmp 3984 7810.tmp 4224 78AC.tmp 256 7919.tmp 5188 79A6.tmp 1852 7A13.tmp 2984 7A81.tmp 1064 7AFE.tmp 828 7B9A.tmp 4180 7C26.tmp 1140 7CB3.tmp 1188 7D40.tmp 5776 7DCC.tmp 1388 7E49.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D955.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E338.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B017.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D013.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B845.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C84E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6955.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 851B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D449.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A068.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1847.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 920B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B207.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 646.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D231.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1833.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F394.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A104.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C380.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F687.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFAE.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4564 wrote to memory of 3324 4564 2026-07-27_d21ccb2007cb255dbbeeee72be711c31_elex_mafia_stealc_tofsee.exe 89 PID 3324 wrote to memory of 4584 3324 41DD.tmp 90 PID 4584 wrote to memory of 5828 4584 4305.tmp 91 PID 5828 wrote to memory of 124 5828 448C.tmp 92 PID 124 wrote to memory of 4536 124 45A5.tmp 93 PID 4536 wrote to memory of 2376 4536 4613.tmp 94 PID 2376 wrote to memory of 5892 2376 4855.tmp 95 PID 5892 wrote to memory of 3364 5892 4901.tmp 96 PID 3364 wrote to memory of 5220 3364 4A2A.tmp 97 PID 5220 wrote to memory of 5228 5220 4B43.tmp 98 PID 5228 wrote to memory of 2300 5228 4C2D.tmp 99 PID 2300 wrote to memory of 4964 2300 4D66.tmp 100 PID 4964 wrote to memory of 5408 4964 4EFC.tmp 101 PID 5408 wrote to memory of 3288 5408 4FF6.tmp 102 PID 3288 wrote to memory of 4452 3288 513E.tmp 103 PID 4452 wrote to memory of 696 4452 5286.tmp 104 PID 696 wrote to memory of 6028 696 5351.tmp 105 PID 6028 wrote to memory of 920 6028 546B.tmp 106 PID 920 wrote to memory of 3976 920 5565.tmp 107 PID 3976 wrote to memory of 5556 3976 567E.tmp 108 PID 5556 wrote to memory of 3232 5556 5797.tmp 109 PID 3232 wrote to memory of 5740 3232 58A1.tmp 110 PID 5740 wrote to memory of 4556 5740 59AA.tmp 111 PID 4556 wrote to memory of 2008 4556 5B02.tmp 112 PID 2008 wrote to memory of 2524 2008 5C1B.tmp 113 PID 2524 wrote to memory of 2296 2524 5D44.tmp 114 PID 2296 wrote to memory of 1992 2296 5E9C.tmp 115 PID 1992 wrote to memory of 1120 1992 5FC5.tmp 116 PID 1120 wrote to memory of 3924 1120 60DE.tmp 117 PID 3924 wrote to memory of 3276 3924 61A9.tmp 118 PID 3276 wrote to memory of 4660 3276 62A3.tmp 119 PID 4660 wrote to memory of 6004 4660 63DC.tmp 120 PID 6004 wrote to memory of 3172 6004 64E5.tmp 121 PID 3172 wrote to memory of 1312 3172 661E.tmp 122 PID 1312 wrote to memory of 4116 1312 6708.tmp 123 PID 4116 wrote to memory of 4604 4116 67B4.tmp 124 PID 4604 wrote to memory of 2864 4604 687F.tmp 125 PID 2864 wrote to memory of 2404 2864 6989.tmp 126 PID 2404 wrote to memory of 4192 2404 6A54.tmp 127 PID 4192 wrote to memory of 4424 4192 6F17.tmp 128 PID 4424 wrote to memory of 4888 4424 6FF1.tmp 129 PID 4888 wrote to memory of 4304 4888 70CC.tmp 130 PID 4304 wrote to memory of 4936 4304 71C6.tmp 131 PID 4936 wrote to memory of 2336 4936 7282.tmp 132 PID 2336 wrote to memory of 2900 2336 733D.tmp 133 PID 2900 wrote to memory of 2892 2900 7408.tmp 134 PID 2892 wrote to memory of 2876 2892 74B4.tmp 135 PID 2876 wrote to memory of 4956 2876 7550.tmp 136 PID 4956 wrote to memory of 968 4956 75ED.tmp 137 PID 968 wrote to memory of 5548 968 7679.tmp 138 PID 5548 wrote to memory of 1564 5548 76F6.tmp 139 PID 1564 wrote to memory of 3984 1564 7773.tmp 140 PID 3984 wrote to memory of 4224 3984 7810.tmp 141 PID 4224 wrote to memory of 256 4224 78AC.tmp 142 PID 256 wrote to memory of 5188 256 7919.tmp 143 PID 5188 wrote to memory of 1852 5188 79A6.tmp 144 PID 1852 wrote to memory of 2984 1852 7A13.tmp 145 PID 2984 wrote to memory of 1064 2984 7A81.tmp 146 PID 1064 wrote to memory of 828 1064 7AFE.tmp 147 PID 828 wrote to memory of 4180 828 7B9A.tmp 148 PID 4180 wrote to memory of 1140 4180 7C26.tmp 149 PID 1140 wrote to memory of 1188 1140 7CB3.tmp 150 PID 1188 wrote to memory of 5776 1188 7D40.tmp 151 PID 5776 wrote to memory of 1388 5776 7DCC.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_d21ccb2007cb255dbbeeee72be711c31_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_d21ccb2007cb255dbbeeee72be711c31_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\41DD.tmp"C:\Users\Admin\AppData\Local\Temp\41DD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\4305.tmp"C:\Users\Admin\AppData\Local\Temp\4305.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\448C.tmp"C:\Users\Admin\AppData\Local\Temp\448C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\45A5.tmp"C:\Users\Admin\AppData\Local\Temp\45A5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\4613.tmp"C:\Users\Admin\AppData\Local\Temp\4613.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\4855.tmp"C:\Users\Admin\AppData\Local\Temp\4855.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\4901.tmp"C:\Users\Admin\AppData\Local\Temp\4901.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"C:\Users\Admin\AppData\Local\Temp\4A2A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\4B43.tmp"C:\Users\Admin\AppData\Local\Temp\4B43.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"C:\Users\Admin\AppData\Local\Temp\4C2D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Users\Admin\AppData\Local\Temp\4D66.tmp"C:\Users\Admin\AppData\Local\Temp\4D66.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\4EFC.tmp"C:\Users\Admin\AppData\Local\Temp\4EFC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\4FF6.tmp"C:\Users\Admin\AppData\Local\Temp\4FF6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\513E.tmp"C:\Users\Admin\AppData\Local\Temp\513E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\5286.tmp"C:\Users\Admin\AppData\Local\Temp\5286.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\5351.tmp"C:\Users\Admin\AppData\Local\Temp\5351.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\546B.tmp"C:\Users\Admin\AppData\Local\Temp\546B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\5565.tmp"C:\Users\Admin\AppData\Local\Temp\5565.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\567E.tmp"C:\Users\Admin\AppData\Local\Temp\567E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\5797.tmp"C:\Users\Admin\AppData\Local\Temp\5797.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\58A1.tmp"C:\Users\Admin\AppData\Local\Temp\58A1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\59AA.tmp"C:\Users\Admin\AppData\Local\Temp\59AA.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\5B02.tmp"C:\Users\Admin\AppData\Local\Temp\5B02.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\5C1B.tmp"C:\Users\Admin\AppData\Local\Temp\5C1B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\5D44.tmp"C:\Users\Admin\AppData\Local\Temp\5D44.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\5E9C.tmp"C:\Users\Admin\AppData\Local\Temp\5E9C.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\5FC5.tmp"C:\Users\Admin\AppData\Local\Temp\5FC5.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\60DE.tmp"C:\Users\Admin\AppData\Local\Temp\60DE.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\61A9.tmp"C:\Users\Admin\AppData\Local\Temp\61A9.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\62A3.tmp"C:\Users\Admin\AppData\Local\Temp\62A3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\63DC.tmp"C:\Users\Admin\AppData\Local\Temp\63DC.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\64E5.tmp"C:\Users\Admin\AppData\Local\Temp\64E5.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\661E.tmp"C:\Users\Admin\AppData\Local\Temp\661E.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\6708.tmp"C:\Users\Admin\AppData\Local\Temp\6708.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\67B4.tmp"C:\Users\Admin\AppData\Local\Temp\67B4.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\687F.tmp"C:\Users\Admin\AppData\Local\Temp\687F.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\6989.tmp"C:\Users\Admin\AppData\Local\Temp\6989.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\6A54.tmp"C:\Users\Admin\AppData\Local\Temp\6A54.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\6F17.tmp"C:\Users\Admin\AppData\Local\Temp\6F17.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\6FF1.tmp"C:\Users\Admin\AppData\Local\Temp\6FF1.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\70CC.tmp"C:\Users\Admin\AppData\Local\Temp\70CC.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\71C6.tmp"C:\Users\Admin\AppData\Local\Temp\71C6.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\7282.tmp"C:\Users\Admin\AppData\Local\Temp\7282.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\733D.tmp"C:\Users\Admin\AppData\Local\Temp\733D.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\7408.tmp"C:\Users\Admin\AppData\Local\Temp\7408.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\74B4.tmp"C:\Users\Admin\AppData\Local\Temp\74B4.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\7550.tmp"C:\Users\Admin\AppData\Local\Temp\7550.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\75ED.tmp"C:\Users\Admin\AppData\Local\Temp\75ED.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\7679.tmp"C:\Users\Admin\AppData\Local\Temp\7679.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\76F6.tmp"C:\Users\Admin\AppData\Local\Temp\76F6.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\7773.tmp"C:\Users\Admin\AppData\Local\Temp\7773.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\7810.tmp"C:\Users\Admin\AppData\Local\Temp\7810.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\78AC.tmp"C:\Users\Admin\AppData\Local\Temp\78AC.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\7919.tmp"C:\Users\Admin\AppData\Local\Temp\7919.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\79A6.tmp"C:\Users\Admin\AppData\Local\Temp\79A6.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\7A13.tmp"C:\Users\Admin\AppData\Local\Temp\7A13.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\7A81.tmp"C:\Users\Admin\AppData\Local\Temp\7A81.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\7AFE.tmp"C:\Users\Admin\AppData\Local\Temp\7AFE.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\7B9A.tmp"C:\Users\Admin\AppData\Local\Temp\7B9A.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\7C26.tmp"C:\Users\Admin\AppData\Local\Temp\7C26.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\7CB3.tmp"C:\Users\Admin\AppData\Local\Temp\7CB3.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\7D40.tmp"C:\Users\Admin\AppData\Local\Temp\7D40.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\7DCC.tmp"C:\Users\Admin\AppData\Local\Temp\7DCC.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\7E49.tmp"C:\Users\Admin\AppData\Local\Temp\7E49.tmp"65⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\7EC6.tmp"C:\Users\Admin\AppData\Local\Temp\7EC6.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\7F63.tmp"C:\Users\Admin\AppData\Local\Temp\7F63.tmp"67⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\7FE0.tmp"C:\Users\Admin\AppData\Local\Temp\7FE0.tmp"68⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\805D.tmp"C:\Users\Admin\AppData\Local\Temp\805D.tmp"69⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\80DA.tmp"C:\Users\Admin\AppData\Local\Temp\80DA.tmp"70⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\8166.tmp"C:\Users\Admin\AppData\Local\Temp\8166.tmp"71⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\81F3.tmp"C:\Users\Admin\AppData\Local\Temp\81F3.tmp"72⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\8260.tmp"C:\Users\Admin\AppData\Local\Temp\8260.tmp"73⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\82DD.tmp"C:\Users\Admin\AppData\Local\Temp\82DD.tmp"74⤵PID:5416
-
C:\Users\Admin\AppData\Local\Temp\835A.tmp"C:\Users\Admin\AppData\Local\Temp\835A.tmp"75⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\83E7.tmp"C:\Users\Admin\AppData\Local\Temp\83E7.tmp"76⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\8454.tmp"C:\Users\Admin\AppData\Local\Temp\8454.tmp"77⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\84C2.tmp"C:\Users\Admin\AppData\Local\Temp\84C2.tmp"78⤵PID:6024
-
C:\Users\Admin\AppData\Local\Temp\853F.tmp"C:\Users\Admin\AppData\Local\Temp\853F.tmp"79⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\85BC.tmp"C:\Users\Admin\AppData\Local\Temp\85BC.tmp"80⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\8658.tmp"C:\Users\Admin\AppData\Local\Temp\8658.tmp"81⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\86E4.tmp"C:\Users\Admin\AppData\Local\Temp\86E4.tmp"82⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\8771.tmp"C:\Users\Admin\AppData\Local\Temp\8771.tmp"83⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\87EE.tmp"C:\Users\Admin\AppData\Local\Temp\87EE.tmp"84⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\889A.tmp"C:\Users\Admin\AppData\Local\Temp\889A.tmp"85⤵PID:200
-
C:\Users\Admin\AppData\Local\Temp\8927.tmp"C:\Users\Admin\AppData\Local\Temp\8927.tmp"86⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\89D2.tmp"C:\Users\Admin\AppData\Local\Temp\89D2.tmp"87⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\8A5F.tmp"C:\Users\Admin\AppData\Local\Temp\8A5F.tmp"88⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\8AEC.tmp"C:\Users\Admin\AppData\Local\Temp\8AEC.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\8B88.tmp"C:\Users\Admin\AppData\Local\Temp\8B88.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\8C15.tmp"C:\Users\Admin\AppData\Local\Temp\8C15.tmp"91⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\8C92.tmp"C:\Users\Admin\AppData\Local\Temp\8C92.tmp"92⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\8D1E.tmp"C:\Users\Admin\AppData\Local\Temp\8D1E.tmp"93⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\8DBA.tmp"C:\Users\Admin\AppData\Local\Temp\8DBA.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\8E66.tmp"C:\Users\Admin\AppData\Local\Temp\8E66.tmp"95⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\8EF3.tmp"C:\Users\Admin\AppData\Local\Temp\8EF3.tmp"96⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\8F80.tmp"C:\Users\Admin\AppData\Local\Temp\8F80.tmp"97⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\900C.tmp"C:\Users\Admin\AppData\Local\Temp\900C.tmp"98⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\9089.tmp"C:\Users\Admin\AppData\Local\Temp\9089.tmp"99⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\9125.tmp"C:\Users\Admin\AppData\Local\Temp\9125.tmp"100⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\91A2.tmp"C:\Users\Admin\AppData\Local\Temp\91A2.tmp"101⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\9210.tmp"C:\Users\Admin\AppData\Local\Temp\9210.tmp"102⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\928D.tmp"C:\Users\Admin\AppData\Local\Temp\928D.tmp"103⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\930A.tmp"C:\Users\Admin\AppData\Local\Temp\930A.tmp"104⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\9377.tmp"C:\Users\Admin\AppData\Local\Temp\9377.tmp"105⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\9404.tmp"C:\Users\Admin\AppData\Local\Temp\9404.tmp"106⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\94A0.tmp"C:\Users\Admin\AppData\Local\Temp\94A0.tmp"107⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\94FE.tmp"C:\Users\Admin\AppData\Local\Temp\94FE.tmp"108⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\959A.tmp"C:\Users\Admin\AppData\Local\Temp\959A.tmp"109⤵PID:5452
-
C:\Users\Admin\AppData\Local\Temp\9646.tmp"C:\Users\Admin\AppData\Local\Temp\9646.tmp"110⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\96C3.tmp"C:\Users\Admin\AppData\Local\Temp\96C3.tmp"111⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\9750.tmp"C:\Users\Admin\AppData\Local\Temp\9750.tmp"112⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\982A.tmp"C:\Users\Admin\AppData\Local\Temp\982A.tmp"113⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\98A7.tmp"C:\Users\Admin\AppData\Local\Temp\98A7.tmp"114⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\9915.tmp"C:\Users\Admin\AppData\Local\Temp\9915.tmp"115⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\99A1.tmp"C:\Users\Admin\AppData\Local\Temp\99A1.tmp"116⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\9A2E.tmp"C:\Users\Admin\AppData\Local\Temp\9A2E.tmp"117⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\9AAB.tmp"C:\Users\Admin\AppData\Local\Temp\9AAB.tmp"118⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\9B28.tmp"C:\Users\Admin\AppData\Local\Temp\9B28.tmp"119⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\9B95.tmp"C:\Users\Admin\AppData\Local\Temp\9B95.tmp"120⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\9C12.tmp"C:\Users\Admin\AppData\Local\Temp\9C12.tmp"121⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\9C8F.tmp"C:\Users\Admin\AppData\Local\Temp\9C8F.tmp"122⤵PID:5224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-