Analysis
- max time kernel
119s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 20:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_7b0ec6ba72a72a59b20fa885cc287c75_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_7b0ec6ba72a72a59b20fa885cc287c75_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-28_7b0ec6ba72a72a59b20fa885cc287c75_elex_mafia_stealc_tofsee.exe
- Size 486KB
- Sample260728-y9lpcsvfnb
- SHA256 eeb4b47ae91a39155c516d081ca6fee84ec3661c57d87588750edfc7be470858
- MD5 7b0ec6ba72a72a59b20fa885cc287c75
- SHA1 5cf54d9c334cb7328aa490d5570676488f100b2b
- SHA512 e37499b43a009c5884f622dd37bded31137eb18c86a6677ecf10c457e9034c3ec9b3eb457373aa8e04133ec41f2931df58542fe7274ce97c6e6a6e6ce8e919ac
- SSDEEP 12288:/U5rCOTeiDEXFmvoReMgmJt4bd5DUKiN8NZ:/UQOJDtwcMszU92N
- TLSH T14DB4F121B984C032E6D202314EE6EBB2682A7D214B2654C77BD4777E6FB52E1E374347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2284 5EFE.tmp 1132 5F9B.tmp 4548 6037.tmp 4328 60E3.tmp 1092 618F.tmp 1940 6269.tmp 4284 6383.tmp 5604 648C.tmp 5440 6538.tmp 2760 65D4.tmp 4344 6690.tmp 936 677A.tmp 4320 6836.tmp 52 6901.tmp 5740 698E.tmp 2580 6A2A.tmp 5252 6AD6.tmp 4168 6B72.tmp 4052 6C4D.tmp 3588 6CE9.tmp 5160 6D85.tmp 5988 6E21.tmp 480 6E9E.tmp 1992 6F3B.tmp 824 6FA8.tmp 4304 7054.tmp 4264 711F.tmp 1684 71CB.tmp 5624 7258.tmp 1272 7323.tmp 3348 73EE.tmp 3916 746B.tmp 5188 7536.tmp 1524 75D2.tmp 716 764F.tmp 4788 76CC.tmp 4260 7759.tmp 4888 77E5.tmp 888 7853.tmp 3084 78D0.tmp 1048 796C.tmp 5248 7A08.tmp 3516 7A85.tmp 2324 7B12.tmp 3392 7B9F.tmp 1452 7C1C.tmp 2444 7C99.tmp 3276 7D25.tmp 3160 7DA2.tmp 2020 7E10.tmp 4968 7E9C.tmp 3240 7F0A.tmp 1740 7F87.tmp 1912 8004.tmp 1600 8081.tmp 2720 814C.tmp 4232 81B9.tmp 4708 8236.tmp 5244 82A3.tmp 3820 8320.tmp 5540 83AD.tmp 3444 841A.tmp 2260 8497.tmp 2340 8534.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A147.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C99F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F10D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 982F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D930.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4056.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 738B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9348.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A668.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5499.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 216F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E805.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E86D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6459.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 241E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B22F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B24A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 939B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A588.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E054.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A77C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6383.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA8C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5416 wrote to memory of 2284 5416 2026-07-28_7b0ec6ba72a72a59b20fa885cc287c75_elex_mafia_stealc_tofsee.exe 88 PID 2284 wrote to memory of 1132 2284 5EFE.tmp 89 PID 1132 wrote to memory of 4548 1132 5F9B.tmp 91 PID 4548 wrote to memory of 4328 4548 6037.tmp 92 PID 4328 wrote to memory of 1092 4328 60E3.tmp 93 PID 1092 wrote to memory of 1940 1092 618F.tmp 94 PID 1940 wrote to memory of 4284 1940 6269.tmp 95 PID 4284 wrote to memory of 5604 4284 6383.tmp 96 PID 5604 wrote to memory of 5440 5604 648C.tmp 97 PID 5440 wrote to memory of 2760 5440 6538.tmp 98 PID 2760 wrote to memory of 4344 2760 65D4.tmp 99 PID 4344 wrote to memory of 936 4344 6690.tmp 100 PID 936 wrote to memory of 4320 936 677A.tmp 101 PID 4320 wrote to memory of 52 4320 6836.tmp 102 PID 52 wrote to memory of 5740 52 6901.tmp 103 PID 5740 wrote to memory of 2580 5740 698E.tmp 104 PID 2580 wrote to memory of 5252 2580 6A2A.tmp 105 PID 5252 wrote to memory of 4168 5252 6AD6.tmp 106 PID 4168 wrote to memory of 4052 4168 6B72.tmp 107 PID 4052 wrote to memory of 3588 4052 6C4D.tmp 108 PID 3588 wrote to memory of 5160 3588 6CE9.tmp 109 PID 5160 wrote to memory of 5988 5160 6D85.tmp 110 PID 5988 wrote to memory of 480 5988 6E21.tmp 111 PID 480 wrote to memory of 1992 480 6E9E.tmp 112 PID 1992 wrote to memory of 824 1992 6F3B.tmp 113 PID 824 wrote to memory of 4304 824 6FA8.tmp 114 PID 4304 wrote to memory of 4264 4304 7054.tmp 115 PID 4264 wrote to memory of 1684 4264 711F.tmp 116 PID 1684 wrote to memory of 5624 1684 71CB.tmp 117 PID 5624 wrote to memory of 1272 5624 7258.tmp 118 PID 1272 wrote to memory of 3348 1272 7323.tmp 119 PID 3348 wrote to memory of 3916 3348 73EE.tmp 120 PID 3916 wrote to memory of 5188 3916 746B.tmp 121 PID 5188 wrote to memory of 1524 5188 7536.tmp 122 PID 1524 wrote to memory of 716 1524 75D2.tmp 123 PID 716 wrote to memory of 4788 716 764F.tmp 124 PID 4788 wrote to memory of 4260 4788 76CC.tmp 125 PID 4260 wrote to memory of 4888 4260 7759.tmp 126 PID 4888 wrote to memory of 888 4888 77E5.tmp 127 PID 888 wrote to memory of 3084 888 7853.tmp 128 PID 3084 wrote to memory of 1048 3084 78D0.tmp 129 PID 1048 wrote to memory of 5248 1048 796C.tmp 130 PID 5248 wrote to memory of 3516 5248 7A08.tmp 131 PID 3516 wrote to memory of 2324 3516 7A85.tmp 132 PID 2324 wrote to memory of 3392 2324 7B12.tmp 133 PID 3392 wrote to memory of 1452 3392 7B9F.tmp 134 PID 1452 wrote to memory of 2444 1452 7C1C.tmp 135 PID 2444 wrote to memory of 3276 2444 7C99.tmp 136 PID 3276 wrote to memory of 3160 3276 7D25.tmp 137 PID 3160 wrote to memory of 2020 3160 7DA2.tmp 138 PID 2020 wrote to memory of 4968 2020 7E10.tmp 139 PID 4968 wrote to memory of 3240 4968 7E9C.tmp 140 PID 3240 wrote to memory of 1740 3240 7F0A.tmp 141 PID 1740 wrote to memory of 1912 1740 7F87.tmp 142 PID 1912 wrote to memory of 1600 1912 8004.tmp 143 PID 1600 wrote to memory of 2720 1600 8081.tmp 144 PID 2720 wrote to memory of 4232 2720 814C.tmp 145 PID 4232 wrote to memory of 4708 4232 81B9.tmp 146 PID 4708 wrote to memory of 5244 4708 8236.tmp 147 PID 5244 wrote to memory of 3820 5244 82A3.tmp 148 PID 3820 wrote to memory of 5540 3820 8320.tmp 149 PID 5540 wrote to memory of 3444 5540 83AD.tmp 150 PID 3444 wrote to memory of 2260 3444 841A.tmp 151 PID 2260 wrote to memory of 2340 2260 8497.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_7b0ec6ba72a72a59b20fa885cc287c75_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_7b0ec6ba72a72a59b20fa885cc287c75_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\5EFE.tmp"C:\Users\Admin\AppData\Local\Temp\5EFE.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\5F9B.tmp"C:\Users\Admin\AppData\Local\Temp\5F9B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\6037.tmp"C:\Users\Admin\AppData\Local\Temp\6037.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\60E3.tmp"C:\Users\Admin\AppData\Local\Temp\60E3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\618F.tmp"C:\Users\Admin\AppData\Local\Temp\618F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\6269.tmp"C:\Users\Admin\AppData\Local\Temp\6269.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\6383.tmp"C:\Users\Admin\AppData\Local\Temp\6383.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\648C.tmp"C:\Users\Admin\AppData\Local\Temp\648C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\6538.tmp"C:\Users\Admin\AppData\Local\Temp\6538.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\65D4.tmp"C:\Users\Admin\AppData\Local\Temp\65D4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\6690.tmp"C:\Users\Admin\AppData\Local\Temp\6690.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\677A.tmp"C:\Users\Admin\AppData\Local\Temp\677A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\6836.tmp"C:\Users\Admin\AppData\Local\Temp\6836.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\6901.tmp"C:\Users\Admin\AppData\Local\Temp\6901.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Users\Admin\AppData\Local\Temp\698E.tmp"C:\Users\Admin\AppData\Local\Temp\698E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\6A2A.tmp"C:\Users\Admin\AppData\Local\Temp\6A2A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\6AD6.tmp"C:\Users\Admin\AppData\Local\Temp\6AD6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\6B72.tmp"C:\Users\Admin\AppData\Local\Temp\6B72.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\6C4D.tmp"C:\Users\Admin\AppData\Local\Temp\6C4D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\6CE9.tmp"C:\Users\Admin\AppData\Local\Temp\6CE9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\6D85.tmp"C:\Users\Admin\AppData\Local\Temp\6D85.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\6E21.tmp"C:\Users\Admin\AppData\Local\Temp\6E21.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\6FA8.tmp"C:\Users\Admin\AppData\Local\Temp\6FA8.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\7054.tmp"C:\Users\Admin\AppData\Local\Temp\7054.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\711F.tmp"C:\Users\Admin\AppData\Local\Temp\711F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\71CB.tmp"C:\Users\Admin\AppData\Local\Temp\71CB.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\7258.tmp"C:\Users\Admin\AppData\Local\Temp\7258.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\7323.tmp"C:\Users\Admin\AppData\Local\Temp\7323.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\73EE.tmp"C:\Users\Admin\AppData\Local\Temp\73EE.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\746B.tmp"C:\Users\Admin\AppData\Local\Temp\746B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\7536.tmp"C:\Users\Admin\AppData\Local\Temp\7536.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\75D2.tmp"C:\Users\Admin\AppData\Local\Temp\75D2.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\764F.tmp"C:\Users\Admin\AppData\Local\Temp\764F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\76CC.tmp"C:\Users\Admin\AppData\Local\Temp\76CC.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\7759.tmp"C:\Users\Admin\AppData\Local\Temp\7759.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\77E5.tmp"C:\Users\Admin\AppData\Local\Temp\77E5.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\7853.tmp"C:\Users\Admin\AppData\Local\Temp\7853.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\78D0.tmp"C:\Users\Admin\AppData\Local\Temp\78D0.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\796C.tmp"C:\Users\Admin\AppData\Local\Temp\796C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\7A08.tmp"C:\Users\Admin\AppData\Local\Temp\7A08.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\7A85.tmp"C:\Users\Admin\AppData\Local\Temp\7A85.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\7B12.tmp"C:\Users\Admin\AppData\Local\Temp\7B12.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\7B9F.tmp"C:\Users\Admin\AppData\Local\Temp\7B9F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\7C1C.tmp"C:\Users\Admin\AppData\Local\Temp\7C1C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\7C99.tmp"C:\Users\Admin\AppData\Local\Temp\7C99.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\7D25.tmp"C:\Users\Admin\AppData\Local\Temp\7D25.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\7DA2.tmp"C:\Users\Admin\AppData\Local\Temp\7DA2.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\7E10.tmp"C:\Users\Admin\AppData\Local\Temp\7E10.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\7E9C.tmp"C:\Users\Admin\AppData\Local\Temp\7E9C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\7F87.tmp"C:\Users\Admin\AppData\Local\Temp\7F87.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\8004.tmp"C:\Users\Admin\AppData\Local\Temp\8004.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\8081.tmp"C:\Users\Admin\AppData\Local\Temp\8081.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\814C.tmp"C:\Users\Admin\AppData\Local\Temp\814C.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\81B9.tmp"C:\Users\Admin\AppData\Local\Temp\81B9.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\8236.tmp"C:\Users\Admin\AppData\Local\Temp\8236.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\82A3.tmp"C:\Users\Admin\AppData\Local\Temp\82A3.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\8320.tmp"C:\Users\Admin\AppData\Local\Temp\8320.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\83AD.tmp"C:\Users\Admin\AppData\Local\Temp\83AD.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\841A.tmp"C:\Users\Admin\AppData\Local\Temp\841A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\8497.tmp"C:\Users\Admin\AppData\Local\Temp\8497.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\8534.tmp"C:\Users\Admin\AppData\Local\Temp\8534.tmp"65⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\85B1.tmp"C:\Users\Admin\AppData\Local\Temp\85B1.tmp"66⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\863D.tmp"C:\Users\Admin\AppData\Local\Temp\863D.tmp"67⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\86BA.tmp"C:\Users\Admin\AppData\Local\Temp\86BA.tmp"68⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\8747.tmp"C:\Users\Admin\AppData\Local\Temp\8747.tmp"69⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\87C4.tmp"C:\Users\Admin\AppData\Local\Temp\87C4.tmp"70⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\8841.tmp"C:\Users\Admin\AppData\Local\Temp\8841.tmp"71⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\88FC.tmp"C:\Users\Admin\AppData\Local\Temp\88FC.tmp"72⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\8979.tmp"C:\Users\Admin\AppData\Local\Temp\8979.tmp"73⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\8A06.tmp"C:\Users\Admin\AppData\Local\Temp\8A06.tmp"74⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\8A93.tmp"C:\Users\Admin\AppData\Local\Temp\8A93.tmp"75⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"76⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"77⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\8C58.tmp"C:\Users\Admin\AppData\Local\Temp\8C58.tmp"78⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"C:\Users\Admin\AppData\Local\Temp\8CE4.tmp"79⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"80⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"81⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"82⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\8F27.tmp"C:\Users\Admin\AppData\Local\Temp\8F27.tmp"83⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\8FB3.tmp"C:\Users\Admin\AppData\Local\Temp\8FB3.tmp"84⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\9030.tmp"C:\Users\Admin\AppData\Local\Temp\9030.tmp"85⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\90DC.tmp"C:\Users\Admin\AppData\Local\Temp\90DC.tmp"86⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\9149.tmp"C:\Users\Admin\AppData\Local\Temp\9149.tmp"87⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\91C6.tmp"C:\Users\Admin\AppData\Local\Temp\91C6.tmp"88⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\9243.tmp"C:\Users\Admin\AppData\Local\Temp\9243.tmp"89⤵PID:252
-
C:\Users\Admin\AppData\Local\Temp\92B1.tmp"C:\Users\Admin\AppData\Local\Temp\92B1.tmp"90⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\931E.tmp"C:\Users\Admin\AppData\Local\Temp\931E.tmp"91⤵PID:5684
-
C:\Users\Admin\AppData\Local\Temp\939B.tmp"C:\Users\Admin\AppData\Local\Temp\939B.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\9418.tmp"C:\Users\Admin\AppData\Local\Temp\9418.tmp"93⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\94B4.tmp"C:\Users\Admin\AppData\Local\Temp\94B4.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\9531.tmp"C:\Users\Admin\AppData\Local\Temp\9531.tmp"95⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\95AE.tmp"C:\Users\Admin\AppData\Local\Temp\95AE.tmp"96⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\962B.tmp"C:\Users\Admin\AppData\Local\Temp\962B.tmp"97⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\96A8.tmp"C:\Users\Admin\AppData\Local\Temp\96A8.tmp"98⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\9735.tmp"C:\Users\Admin\AppData\Local\Temp\9735.tmp"99⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\97B2.tmp"C:\Users\Admin\AppData\Local\Temp\97B2.tmp"100⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\982F.tmp"C:\Users\Admin\AppData\Local\Temp\982F.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\98AC.tmp"C:\Users\Admin\AppData\Local\Temp\98AC.tmp"102⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\9929.tmp"C:\Users\Admin\AppData\Local\Temp\9929.tmp"103⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\99B6.tmp"C:\Users\Admin\AppData\Local\Temp\99B6.tmp"104⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\9A33.tmp"C:\Users\Admin\AppData\Local\Temp\9A33.tmp"105⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\9ACF.tmp"C:\Users\Admin\AppData\Local\Temp\9ACF.tmp"106⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"107⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"C:\Users\Admin\AppData\Local\Temp\9BD9.tmp"108⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\9C46.tmp"C:\Users\Admin\AppData\Local\Temp\9C46.tmp"109⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\9CC3.tmp"C:\Users\Admin\AppData\Local\Temp\9CC3.tmp"110⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\9D40.tmp"C:\Users\Admin\AppData\Local\Temp\9D40.tmp"111⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\9DEC.tmp"C:\Users\Admin\AppData\Local\Temp\9DEC.tmp"112⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\9E59.tmp"C:\Users\Admin\AppData\Local\Temp\9E59.tmp"113⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\9ED6.tmp"C:\Users\Admin\AppData\Local\Temp\9ED6.tmp"114⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\9F82.tmp"C:\Users\Admin\AppData\Local\Temp\9F82.tmp"115⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\A01E.tmp"C:\Users\Admin\AppData\Local\Temp\A01E.tmp"116⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\A0AB.tmp"C:\Users\Admin\AppData\Local\Temp\A0AB.tmp"117⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\A147.tmp"C:\Users\Admin\AppData\Local\Temp\A147.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\A1D4.tmp"C:\Users\Admin\AppData\Local\Temp\A1D4.tmp"119⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\A241.tmp"C:\Users\Admin\AppData\Local\Temp\A241.tmp"120⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\A2BE.tmp"C:\Users\Admin\AppData\Local\Temp\A2BE.tmp"121⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\A34B.tmp"C:\Users\Admin\AppData\Local\Temp\A34B.tmp"122⤵PID:5456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-