Analysis
- max time kernel
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 19:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_f59a736bca9926c6355d175bc7c55403_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_f59a736bca9926c6355d175bc7c55403_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-29_f59a736bca9926c6355d175bc7c55403_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260729-xsen2sdd38
- SHA256 7cd5af4d911a1c10cdea79ab79451860d96e44578826ebd730e49f4a4abbb58f
- MD5 f59a736bca9926c6355d175bc7c55403
- SHA1 b0c9437fb26b118d435024db7ba38fa072a6cdc0
- SHA512 448f15f47e2e9cdacfe97ada5dbf48f1c8aa12334f668a3e62e3da0b9f17a191d2ba4366987d0170aa04feffc3d8e986f7ace3c17be3c14d4ca024de1fd0fab8
- SSDEEP 6144:oorf3lPvovsgZnqG2C7mOTeiL/DLitCHYFmVOAEGzBEhcRAWDItbqYK58tlsH3jm:NU5rCOTeijQFw3EABjRAgIN08ITZwlH
- TLSH T19DB4E125B685C132E59302310AEAEBB16A3ABD31572294C77B94677E2F713E0E375343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3236 4491.tmp 3428 453D.tmp 5584 45F8.tmp 4840 4694.tmp 5888 4731.tmp 1280 480B.tmp 1360 4888.tmp 2376 4915.tmp 4992 49B1.tmp 5612 4A5D.tmp 2836 4B86.tmp 3424 4C03.tmp 2848 4CAF.tmp 4728 4D99.tmp 1424 4E45.tmp 108 4EE1.tmp 2372 4F6E.tmp 5904 5068.tmp 4988 5143.tmp 4304 51DF.tmp 3536 529B.tmp 1492 5337.tmp 5408 53F2.tmp 1108 54BD.tmp 4380 5569.tmp 2360 5606.tmp 3544 56B1.tmp 3436 577D.tmp 5248 5838.tmp 4800 58C5.tmp 4812 5990.tmp 3252 5A6B.tmp 5628 5B16.tmp 6084 5BA3.tmp 3660 5C5F.tmp 1340 5CCC.tmp 1556 5D59.tmp 2844 5DC6.tmp 1716 5E43.tmp 4944 5EC0.tmp 800 5F4D.tmp 5516 5FD9.tmp 1932 6056.tmp 3900 60E3.tmp 3152 6150.tmp 4152 61DD.tmp 1708 6279.tmp 1964 62E6.tmp 4864 6383.tmp 1084 6400.tmp 2340 647D.tmp 4264 6509.tmp 5688 6586.tmp 1444 6603.tmp 5956 6690.tmp 1700 671D.tmp 5396 67A9.tmp 1868 6826.tmp 5448 6894.tmp 3212 6920.tmp 3128 69AD.tmp 3068 6A39.tmp 4296 6AB6.tmp 1316 6B33.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 712A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2008.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3114.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5286.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D93B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F435.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 480B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2576.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B339.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 699.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7735.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 785E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B491.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E408.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 885B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B056.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3440.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D49C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B40F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A36A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F090.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3579.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A24C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2869.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4893.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 920 wrote to memory of 3236 920 2026-07-29_f59a736bca9926c6355d175bc7c55403_elex_mafia_stealc_tofsee.exe 89 PID 3236 wrote to memory of 3428 3236 4491.tmp 90 PID 3428 wrote to memory of 5584 3428 453D.tmp 91 PID 5584 wrote to memory of 4840 5584 45F8.tmp 92 PID 4840 wrote to memory of 5888 4840 4694.tmp 93 PID 5888 wrote to memory of 1280 5888 4731.tmp 94 PID 1280 wrote to memory of 1360 1280 480B.tmp 95 PID 1360 wrote to memory of 2376 1360 4888.tmp 96 PID 2376 wrote to memory of 4992 2376 4915.tmp 97 PID 4992 wrote to memory of 5612 4992 49B1.tmp 98 PID 5612 wrote to memory of 2836 5612 4A5D.tmp 99 PID 2836 wrote to memory of 3424 2836 4B86.tmp 100 PID 3424 wrote to memory of 2848 3424 4C03.tmp 101 PID 2848 wrote to memory of 4728 2848 4CAF.tmp 102 PID 4728 wrote to memory of 1424 4728 4D99.tmp 103 PID 1424 wrote to memory of 108 1424 4E45.tmp 104 PID 108 wrote to memory of 2372 108 4EE1.tmp 105 PID 2372 wrote to memory of 5904 2372 4F6E.tmp 106 PID 5904 wrote to memory of 4988 5904 5068.tmp 107 PID 4988 wrote to memory of 4304 4988 5143.tmp 108 PID 4304 wrote to memory of 3536 4304 51DF.tmp 109 PID 3536 wrote to memory of 1492 3536 529B.tmp 110 PID 1492 wrote to memory of 5408 1492 5337.tmp 111 PID 5408 wrote to memory of 1108 5408 53F2.tmp 112 PID 1108 wrote to memory of 4380 1108 54BD.tmp 113 PID 4380 wrote to memory of 2360 4380 5569.tmp 114 PID 2360 wrote to memory of 3544 2360 5606.tmp 115 PID 3544 wrote to memory of 3436 3544 56B1.tmp 116 PID 3436 wrote to memory of 5248 3436 577D.tmp 117 PID 5248 wrote to memory of 4800 5248 5838.tmp 118 PID 4800 wrote to memory of 4812 4800 58C5.tmp 119 PID 4812 wrote to memory of 3252 4812 5990.tmp 120 PID 3252 wrote to memory of 5628 3252 5A6B.tmp 121 PID 5628 wrote to memory of 6084 5628 5B16.tmp 122 PID 6084 wrote to memory of 3660 6084 5BA3.tmp 123 PID 3660 wrote to memory of 1340 3660 5C5F.tmp 124 PID 1340 wrote to memory of 1556 1340 5CCC.tmp 125 PID 1556 wrote to memory of 2844 1556 5D59.tmp 126 PID 2844 wrote to memory of 1716 2844 5DC6.tmp 127 PID 1716 wrote to memory of 4944 1716 5E43.tmp 128 PID 4944 wrote to memory of 800 4944 5EC0.tmp 129 PID 800 wrote to memory of 5516 800 5F4D.tmp 130 PID 5516 wrote to memory of 1932 5516 5FD9.tmp 131 PID 1932 wrote to memory of 3900 1932 6056.tmp 132 PID 3900 wrote to memory of 3152 3900 60E3.tmp 133 PID 3152 wrote to memory of 4152 3152 6150.tmp 134 PID 4152 wrote to memory of 1708 4152 61DD.tmp 135 PID 1708 wrote to memory of 1964 1708 6279.tmp 136 PID 1964 wrote to memory of 4864 1964 62E6.tmp 137 PID 4864 wrote to memory of 1084 4864 6383.tmp 138 PID 1084 wrote to memory of 2340 1084 6400.tmp 139 PID 2340 wrote to memory of 4264 2340 647D.tmp 140 PID 4264 wrote to memory of 5688 4264 6509.tmp 141 PID 5688 wrote to memory of 1444 5688 6586.tmp 142 PID 1444 wrote to memory of 5956 1444 6603.tmp 143 PID 5956 wrote to memory of 1700 5956 6690.tmp 144 PID 1700 wrote to memory of 5396 1700 671D.tmp 145 PID 5396 wrote to memory of 1868 5396 67A9.tmp 146 PID 1868 wrote to memory of 5448 1868 6826.tmp 147 PID 5448 wrote to memory of 3212 5448 6894.tmp 148 PID 3212 wrote to memory of 3128 3212 6920.tmp 149 PID 3128 wrote to memory of 3068 3128 69AD.tmp 150 PID 3068 wrote to memory of 4296 3068 6A39.tmp 151 PID 4296 wrote to memory of 1316 4296 6AB6.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_f59a736bca9926c6355d175bc7c55403_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_f59a736bca9926c6355d175bc7c55403_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\4491.tmp"C:\Users\Admin\AppData\Local\Temp\4491.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\453D.tmp"C:\Users\Admin\AppData\Local\Temp\453D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\45F8.tmp"C:\Users\Admin\AppData\Local\Temp\45F8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\4694.tmp"C:\Users\Admin\AppData\Local\Temp\4694.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\4731.tmp"C:\Users\Admin\AppData\Local\Temp\4731.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\480B.tmp"C:\Users\Admin\AppData\Local\Temp\480B.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\4888.tmp"C:\Users\Admin\AppData\Local\Temp\4888.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\4915.tmp"C:\Users\Admin\AppData\Local\Temp\4915.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\49B1.tmp"C:\Users\Admin\AppData\Local\Temp\49B1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"C:\Users\Admin\AppData\Local\Temp\4A5D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\4B86.tmp"C:\Users\Admin\AppData\Local\Temp\4B86.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\4C03.tmp"C:\Users\Admin\AppData\Local\Temp\4C03.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\4D99.tmp"C:\Users\Admin\AppData\Local\Temp\4D99.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\4E45.tmp"C:\Users\Admin\AppData\Local\Temp\4E45.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Users\Admin\AppData\Local\Temp\4F6E.tmp"C:\Users\Admin\AppData\Local\Temp\4F6E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\5068.tmp"C:\Users\Admin\AppData\Local\Temp\5068.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\5143.tmp"C:\Users\Admin\AppData\Local\Temp\5143.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\51DF.tmp"C:\Users\Admin\AppData\Local\Temp\51DF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\529B.tmp"C:\Users\Admin\AppData\Local\Temp\529B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\5337.tmp"C:\Users\Admin\AppData\Local\Temp\5337.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\53F2.tmp"C:\Users\Admin\AppData\Local\Temp\53F2.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\54BD.tmp"C:\Users\Admin\AppData\Local\Temp\54BD.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\5569.tmp"C:\Users\Admin\AppData\Local\Temp\5569.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\5606.tmp"C:\Users\Admin\AppData\Local\Temp\5606.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\56B1.tmp"C:\Users\Admin\AppData\Local\Temp\56B1.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\577D.tmp"C:\Users\Admin\AppData\Local\Temp\577D.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\5838.tmp"C:\Users\Admin\AppData\Local\Temp\5838.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\58C5.tmp"C:\Users\Admin\AppData\Local\Temp\58C5.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\5990.tmp"C:\Users\Admin\AppData\Local\Temp\5990.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\5A6B.tmp"C:\Users\Admin\AppData\Local\Temp\5A6B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\5B16.tmp"C:\Users\Admin\AppData\Local\Temp\5B16.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\5BA3.tmp"C:\Users\Admin\AppData\Local\Temp\5BA3.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\5C5F.tmp"C:\Users\Admin\AppData\Local\Temp\5C5F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\5CCC.tmp"C:\Users\Admin\AppData\Local\Temp\5CCC.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\5D59.tmp"C:\Users\Admin\AppData\Local\Temp\5D59.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\5E43.tmp"C:\Users\Admin\AppData\Local\Temp\5E43.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\5EC0.tmp"C:\Users\Admin\AppData\Local\Temp\5EC0.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\5F4D.tmp"C:\Users\Admin\AppData\Local\Temp\5F4D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\5FD9.tmp"C:\Users\Admin\AppData\Local\Temp\5FD9.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\6056.tmp"C:\Users\Admin\AppData\Local\Temp\6056.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\60E3.tmp"C:\Users\Admin\AppData\Local\Temp\60E3.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\6150.tmp"C:\Users\Admin\AppData\Local\Temp\6150.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\61DD.tmp"C:\Users\Admin\AppData\Local\Temp\61DD.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\6279.tmp"C:\Users\Admin\AppData\Local\Temp\6279.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\62E6.tmp"C:\Users\Admin\AppData\Local\Temp\62E6.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\6383.tmp"C:\Users\Admin\AppData\Local\Temp\6383.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\6400.tmp"C:\Users\Admin\AppData\Local\Temp\6400.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\647D.tmp"C:\Users\Admin\AppData\Local\Temp\647D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\6509.tmp"C:\Users\Admin\AppData\Local\Temp\6509.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\6586.tmp"C:\Users\Admin\AppData\Local\Temp\6586.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\6603.tmp"C:\Users\Admin\AppData\Local\Temp\6603.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\6690.tmp"C:\Users\Admin\AppData\Local\Temp\6690.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\671D.tmp"C:\Users\Admin\AppData\Local\Temp\671D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\67A9.tmp"C:\Users\Admin\AppData\Local\Temp\67A9.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\6826.tmp"C:\Users\Admin\AppData\Local\Temp\6826.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\6894.tmp"C:\Users\Admin\AppData\Local\Temp\6894.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\6920.tmp"C:\Users\Admin\AppData\Local\Temp\6920.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\69AD.tmp"C:\Users\Admin\AppData\Local\Temp\69AD.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\6A39.tmp"C:\Users\Admin\AppData\Local\Temp\6A39.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\6AB6.tmp"C:\Users\Admin\AppData\Local\Temp\6AB6.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\6B33.tmp"C:\Users\Admin\AppData\Local\Temp\6B33.tmp"65⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\6BB0.tmp"C:\Users\Admin\AppData\Local\Temp\6BB0.tmp"66⤵PID:6068
-
C:\Users\Admin\AppData\Local\Temp\6C1E.tmp"C:\Users\Admin\AppData\Local\Temp\6C1E.tmp"67⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\6C9B.tmp"C:\Users\Admin\AppData\Local\Temp\6C9B.tmp"68⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\6D27.tmp"C:\Users\Admin\AppData\Local\Temp\6D27.tmp"69⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\6DA4.tmp"C:\Users\Admin\AppData\Local\Temp\6DA4.tmp"70⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\6E12.tmp"C:\Users\Admin\AppData\Local\Temp\6E12.tmp"71⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\6E7F.tmp"C:\Users\Admin\AppData\Local\Temp\6E7F.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\6EFC.tmp"C:\Users\Admin\AppData\Local\Temp\6EFC.tmp"73⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\6F6A.tmp"C:\Users\Admin\AppData\Local\Temp\6F6A.tmp"74⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\6FE7.tmp"C:\Users\Admin\AppData\Local\Temp\6FE7.tmp"75⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\7064.tmp"C:\Users\Admin\AppData\Local\Temp\7064.tmp"76⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\7100.tmp"C:\Users\Admin\AppData\Local\Temp\7100.tmp"77⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\718C.tmp"C:\Users\Admin\AppData\Local\Temp\718C.tmp"78⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\7238.tmp"C:\Users\Admin\AppData\Local\Temp\7238.tmp"79⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\72D5.tmp"C:\Users\Admin\AppData\Local\Temp\72D5.tmp"80⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\7361.tmp"C:\Users\Admin\AppData\Local\Temp\7361.tmp"81⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\73EE.tmp"C:\Users\Admin\AppData\Local\Temp\73EE.tmp"82⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\748A.tmp"C:\Users\Admin\AppData\Local\Temp\748A.tmp"83⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\7507.tmp"C:\Users\Admin\AppData\Local\Temp\7507.tmp"84⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\7574.tmp"C:\Users\Admin\AppData\Local\Temp\7574.tmp"85⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\75F1.tmp"C:\Users\Admin\AppData\Local\Temp\75F1.tmp"86⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\768E.tmp"C:\Users\Admin\AppData\Local\Temp\768E.tmp"87⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\770B.tmp"C:\Users\Admin\AppData\Local\Temp\770B.tmp"88⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\7797.tmp"C:\Users\Admin\AppData\Local\Temp\7797.tmp"89⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\7843.tmp"C:\Users\Admin\AppData\Local\Temp\7843.tmp"90⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\78DF.tmp"C:\Users\Admin\AppData\Local\Temp\78DF.tmp"91⤵PID:5404
-
C:\Users\Admin\AppData\Local\Temp\795C.tmp"C:\Users\Admin\AppData\Local\Temp\795C.tmp"92⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\79E9.tmp"C:\Users\Admin\AppData\Local\Temp\79E9.tmp"93⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\7A66.tmp"C:\Users\Admin\AppData\Local\Temp\7A66.tmp"94⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\7AE3.tmp"C:\Users\Admin\AppData\Local\Temp\7AE3.tmp"95⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\7B70.tmp"C:\Users\Admin\AppData\Local\Temp\7B70.tmp"96⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"97⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\7C89.tmp"C:\Users\Admin\AppData\Local\Temp\7C89.tmp"98⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\7CF6.tmp"C:\Users\Admin\AppData\Local\Temp\7CF6.tmp"99⤵PID:6096
-
C:\Users\Admin\AppData\Local\Temp\7D83.tmp"C:\Users\Admin\AppData\Local\Temp\7D83.tmp"100⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"101⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\7E6D.tmp"C:\Users\Admin\AppData\Local\Temp\7E6D.tmp"102⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\7EEA.tmp"C:\Users\Admin\AppData\Local\Temp\7EEA.tmp"103⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\7F67.tmp"C:\Users\Admin\AppData\Local\Temp\7F67.tmp"104⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"105⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\8071.tmp"C:\Users\Admin\AppData\Local\Temp\8071.tmp"106⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\80FE.tmp"C:\Users\Admin\AppData\Local\Temp\80FE.tmp"107⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\817B.tmp"C:\Users\Admin\AppData\Local\Temp\817B.tmp"108⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\81F8.tmp"C:\Users\Admin\AppData\Local\Temp\81F8.tmp"109⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\8275.tmp"C:\Users\Admin\AppData\Local\Temp\8275.tmp"110⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\82E2.tmp"C:\Users\Admin\AppData\Local\Temp\82E2.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\837E.tmp"C:\Users\Admin\AppData\Local\Temp\837E.tmp"112⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\83EC.tmp"C:\Users\Admin\AppData\Local\Temp\83EC.tmp"113⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\8478.tmp"C:\Users\Admin\AppData\Local\Temp\8478.tmp"114⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\8514.tmp"C:\Users\Admin\AppData\Local\Temp\8514.tmp"115⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\85A1.tmp"C:\Users\Admin\AppData\Local\Temp\85A1.tmp"116⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\861E.tmp"C:\Users\Admin\AppData\Local\Temp\861E.tmp"117⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\86AB.tmp"C:\Users\Admin\AppData\Local\Temp\86AB.tmp"118⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\8728.tmp"C:\Users\Admin\AppData\Local\Temp\8728.tmp"119⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\87B4.tmp"C:\Users\Admin\AppData\Local\Temp\87B4.tmp"120⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\8851.tmp"C:\Users\Admin\AppData\Local\Temp\8851.tmp"121⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\88CE.tmp"C:\Users\Admin\AppData\Local\Temp\88CE.tmp"122⤵PID:4776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-