Analysis
- max time kernel
124s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 22:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_73b15fb1869e7004fc6f6a3f23455390_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_73b15fb1869e7004fc6f6a3f23455390_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-30_73b15fb1869e7004fc6f6a3f23455390_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260730-2cv4bage95
- SHA256 2a4cf9651c6cc9b466e2e5b3cbf1686659d855e5c3c96b0b10226c358f223fd1
- MD5 73b15fb1869e7004fc6f6a3f23455390
- SHA1 b8f0cb2ab30a0832065e2490d653ee123b643277
- SHA512 3517c56df32fbc6ad9a5c15065e46da12eaa093c7d7d0e36ef16ae2ffacdc8f10ce78d41a0692e593a94e800a98f61b03c3a57b4e4b687c3503be571933e7fb8
- SSDEEP 12288:wU5rCOTeiDUg4zIYonrJpkNT66LosKQreNZ+3/v+I9hUG2VA:wUQOJDYIYiub7KQreNGEA
- TLSH T1F1E4D02177D88632E5F7037859B5E6604D7EBD326722D6CF2F9016AE19B1BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4740 4A0F.tmp 2528 4ABB.tmp 5064 4C90.tmp 3724 4E45.tmp 2112 4EE1.tmp 5944 4F5E.tmp 3112 4FEB.tmp 4596 520E.tmp 2544 5356.tmp 5584 5450.tmp 5800 5579.tmp 5060 5673.tmp 6020 576D.tmp 3952 5877.tmp 1168 59DE.tmp 5472 5B16.tmp 5520 5C10.tmp 1484 5D2A.tmp 924 5E24.tmp 2356 5EFE.tmp 5248 5FE9.tmp 4640 6121.tmp 5784 622B.tmp 4476 6325.tmp 5316 642F.tmp 1048 6577.tmp 3384 66A0.tmp 4696 67C8.tmp 2456 68D2.tmp 5828 69EB.tmp 3064 6B14.tmp 568 6C3D.tmp 5948 6D47.tmp 4928 6E41.tmp 3296 6F3B.tmp 6092 7025.tmp 3412 713E.tmp 4508 7229.tmp 5920 72F4.tmp 2608 73BF.tmp 1416 743C.tmp 1720 74E8.tmp 6068 7594.tmp 4924 7640.tmp 4460 76DC.tmp 1320 77A7.tmp 5612 7853.tmp 5488 78EF.tmp 4340 798B.tmp 2324 7A37.tmp 5232 7AB4.tmp 2540 7BFC.tmp 4148 7C79.tmp 3612 7D16.tmp 4232 7DA2.tmp 3520 7E1F.tmp 968 7EAC.tmp 4872 7F48.tmp 916 8004.tmp 3480 80A0.tmp 1384 814C.tmp 2320 81E8.tmp 1704 8284.tmp 4824 8311.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E65A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 175D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A01E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D836.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2344.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4315.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C123.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8128.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 107C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D67B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F619.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ACF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C267.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3346.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7001.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 814C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6217.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C097.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D632.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3800 wrote to memory of 4740 3800 2026-07-30_73b15fb1869e7004fc6f6a3f23455390_elex_mafia_stealc_tofsee.exe 89 PID 4740 wrote to memory of 2528 4740 4A0F.tmp 90 PID 2528 wrote to memory of 5064 2528 4ABB.tmp 91 PID 5064 wrote to memory of 3724 5064 4C90.tmp 92 PID 3724 wrote to memory of 2112 3724 4E45.tmp 93 PID 2112 wrote to memory of 5944 2112 4EE1.tmp 94 PID 5944 wrote to memory of 3112 5944 4F5E.tmp 95 PID 3112 wrote to memory of 4596 3112 4FEB.tmp 96 PID 4596 wrote to memory of 2544 4596 520E.tmp 97 PID 2544 wrote to memory of 5584 2544 5356.tmp 98 PID 5584 wrote to memory of 5800 5584 5450.tmp 99 PID 5800 wrote to memory of 5060 5800 5579.tmp 100 PID 5060 wrote to memory of 6020 5060 5673.tmp 101 PID 6020 wrote to memory of 3952 6020 576D.tmp 102 PID 3952 wrote to memory of 1168 3952 5877.tmp 103 PID 1168 wrote to memory of 5472 1168 59DE.tmp 104 PID 5472 wrote to memory of 5520 5472 5B16.tmp 105 PID 5520 wrote to memory of 1484 5520 5C10.tmp 106 PID 1484 wrote to memory of 924 1484 5D2A.tmp 107 PID 924 wrote to memory of 2356 924 5E24.tmp 108 PID 2356 wrote to memory of 5248 2356 5EFE.tmp 109 PID 5248 wrote to memory of 4640 5248 5FE9.tmp 110 PID 4640 wrote to memory of 5784 4640 6121.tmp 111 PID 5784 wrote to memory of 4476 5784 622B.tmp 112 PID 4476 wrote to memory of 5316 4476 6325.tmp 113 PID 5316 wrote to memory of 1048 5316 642F.tmp 114 PID 1048 wrote to memory of 3384 1048 6577.tmp 115 PID 3384 wrote to memory of 4696 3384 66A0.tmp 116 PID 4696 wrote to memory of 2456 4696 67C8.tmp 117 PID 2456 wrote to memory of 5828 2456 68D2.tmp 118 PID 5828 wrote to memory of 3064 5828 69EB.tmp 119 PID 3064 wrote to memory of 568 3064 6B14.tmp 120 PID 568 wrote to memory of 5948 568 6C3D.tmp 121 PID 5948 wrote to memory of 4928 5948 6D47.tmp 122 PID 4928 wrote to memory of 3296 4928 6E41.tmp 123 PID 3296 wrote to memory of 6092 3296 6F3B.tmp 124 PID 6092 wrote to memory of 3412 6092 7025.tmp 125 PID 3412 wrote to memory of 4508 3412 713E.tmp 126 PID 4508 wrote to memory of 5920 4508 7229.tmp 127 PID 5920 wrote to memory of 2608 5920 72F4.tmp 128 PID 2608 wrote to memory of 1416 2608 73BF.tmp 129 PID 1416 wrote to memory of 1720 1416 743C.tmp 130 PID 1720 wrote to memory of 6068 1720 74E8.tmp 131 PID 6068 wrote to memory of 4924 6068 7594.tmp 132 PID 4924 wrote to memory of 4460 4924 7640.tmp 133 PID 4460 wrote to memory of 1320 4460 76DC.tmp 134 PID 1320 wrote to memory of 5612 1320 77A7.tmp 135 PID 5612 wrote to memory of 5488 5612 7853.tmp 136 PID 5488 wrote to memory of 4340 5488 78EF.tmp 137 PID 4340 wrote to memory of 2324 4340 798B.tmp 138 PID 2324 wrote to memory of 5232 2324 7A37.tmp 139 PID 2788 wrote to memory of 2540 2788 7B70.tmp 141 PID 2540 wrote to memory of 4148 2540 7BFC.tmp 142 PID 4148 wrote to memory of 3612 4148 7C79.tmp 143 PID 3612 wrote to memory of 4232 3612 7D16.tmp 144 PID 4232 wrote to memory of 3520 4232 7DA2.tmp 145 PID 3520 wrote to memory of 968 3520 7E1F.tmp 146 PID 968 wrote to memory of 4872 968 7EAC.tmp 147 PID 4872 wrote to memory of 916 4872 7F48.tmp 148 PID 916 wrote to memory of 3480 916 8004.tmp 149 PID 3480 wrote to memory of 1384 3480 80A0.tmp 150 PID 1384 wrote to memory of 2320 1384 814C.tmp 151 PID 2320 wrote to memory of 1704 2320 81E8.tmp 152 PID 1704 wrote to memory of 4824 1704 8284.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_73b15fb1869e7004fc6f6a3f23455390_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_73b15fb1869e7004fc6f6a3f23455390_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\4A0F.tmp"C:\Users\Admin\AppData\Local\Temp\4A0F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\4ABB.tmp"C:\Users\Admin\AppData\Local\Temp\4ABB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\4C90.tmp"C:\Users\Admin\AppData\Local\Temp\4C90.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\4E45.tmp"C:\Users\Admin\AppData\Local\Temp\4E45.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\4F5E.tmp"C:\Users\Admin\AppData\Local\Temp\4F5E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\4FEB.tmp"C:\Users\Admin\AppData\Local\Temp\4FEB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\520E.tmp"C:\Users\Admin\AppData\Local\Temp\520E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\5356.tmp"C:\Users\Admin\AppData\Local\Temp\5356.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\5450.tmp"C:\Users\Admin\AppData\Local\Temp\5450.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\5579.tmp"C:\Users\Admin\AppData\Local\Temp\5579.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\5673.tmp"C:\Users\Admin\AppData\Local\Temp\5673.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\576D.tmp"C:\Users\Admin\AppData\Local\Temp\576D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\5877.tmp"C:\Users\Admin\AppData\Local\Temp\5877.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\59DE.tmp"C:\Users\Admin\AppData\Local\Temp\59DE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\5B16.tmp"C:\Users\Admin\AppData\Local\Temp\5B16.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\5C10.tmp"C:\Users\Admin\AppData\Local\Temp\5C10.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\5D2A.tmp"C:\Users\Admin\AppData\Local\Temp\5D2A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\5E24.tmp"C:\Users\Admin\AppData\Local\Temp\5E24.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\5EFE.tmp"C:\Users\Admin\AppData\Local\Temp\5EFE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\5FE9.tmp"C:\Users\Admin\AppData\Local\Temp\5FE9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\6121.tmp"C:\Users\Admin\AppData\Local\Temp\6121.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\622B.tmp"C:\Users\Admin\AppData\Local\Temp\622B.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\6325.tmp"C:\Users\Admin\AppData\Local\Temp\6325.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\642F.tmp"C:\Users\Admin\AppData\Local\Temp\642F.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\6577.tmp"C:\Users\Admin\AppData\Local\Temp\6577.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\66A0.tmp"C:\Users\Admin\AppData\Local\Temp\66A0.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\68D2.tmp"C:\Users\Admin\AppData\Local\Temp\68D2.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\69EB.tmp"C:\Users\Admin\AppData\Local\Temp\69EB.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\6B14.tmp"C:\Users\Admin\AppData\Local\Temp\6B14.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\6D47.tmp"C:\Users\Admin\AppData\Local\Temp\6D47.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\6E41.tmp"C:\Users\Admin\AppData\Local\Temp\6E41.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\7025.tmp"C:\Users\Admin\AppData\Local\Temp\7025.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\713E.tmp"C:\Users\Admin\AppData\Local\Temp\713E.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\7229.tmp"C:\Users\Admin\AppData\Local\Temp\7229.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\72F4.tmp"C:\Users\Admin\AppData\Local\Temp\72F4.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\73BF.tmp"C:\Users\Admin\AppData\Local\Temp\73BF.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\743C.tmp"C:\Users\Admin\AppData\Local\Temp\743C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\74E8.tmp"C:\Users\Admin\AppData\Local\Temp\74E8.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\7594.tmp"C:\Users\Admin\AppData\Local\Temp\7594.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\7640.tmp"C:\Users\Admin\AppData\Local\Temp\7640.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\76DC.tmp"C:\Users\Admin\AppData\Local\Temp\76DC.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\77A7.tmp"C:\Users\Admin\AppData\Local\Temp\77A7.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\7853.tmp"C:\Users\Admin\AppData\Local\Temp\7853.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\78EF.tmp"C:\Users\Admin\AppData\Local\Temp\78EF.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\798B.tmp"C:\Users\Admin\AppData\Local\Temp\798B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\7A37.tmp"C:\Users\Admin\AppData\Local\Temp\7A37.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\7AB4.tmp"C:\Users\Admin\AppData\Local\Temp\7AB4.tmp"52⤵
- Executes dropped EXE
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\7B70.tmp"C:\Users\Admin\AppData\Local\Temp\7B70.tmp"53⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\7C79.tmp"C:\Users\Admin\AppData\Local\Temp\7C79.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\7D16.tmp"C:\Users\Admin\AppData\Local\Temp\7D16.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\7DA2.tmp"C:\Users\Admin\AppData\Local\Temp\7DA2.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\7E1F.tmp"C:\Users\Admin\AppData\Local\Temp\7E1F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\7EAC.tmp"C:\Users\Admin\AppData\Local\Temp\7EAC.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\7F48.tmp"C:\Users\Admin\AppData\Local\Temp\7F48.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\8004.tmp"C:\Users\Admin\AppData\Local\Temp\8004.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\80A0.tmp"C:\Users\Admin\AppData\Local\Temp\80A0.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\814C.tmp"C:\Users\Admin\AppData\Local\Temp\814C.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\81E8.tmp"C:\Users\Admin\AppData\Local\Temp\81E8.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\8284.tmp"C:\Users\Admin\AppData\Local\Temp\8284.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\8311.tmp"C:\Users\Admin\AppData\Local\Temp\8311.tmp"66⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\83AD.tmp"C:\Users\Admin\AppData\Local\Temp\83AD.tmp"67⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\8459.tmp"C:\Users\Admin\AppData\Local\Temp\8459.tmp"68⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\84F5.tmp"C:\Users\Admin\AppData\Local\Temp\84F5.tmp"69⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\85A1.tmp"C:\Users\Admin\AppData\Local\Temp\85A1.tmp"70⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\861E.tmp"C:\Users\Admin\AppData\Local\Temp\861E.tmp"71⤵PID:5588
-
C:\Users\Admin\AppData\Local\Temp\86CA.tmp"C:\Users\Admin\AppData\Local\Temp\86CA.tmp"72⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\87A5.tmp"C:\Users\Admin\AppData\Local\Temp\87A5.tmp"73⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\8841.tmp"C:\Users\Admin\AppData\Local\Temp\8841.tmp"74⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\88CE.tmp"C:\Users\Admin\AppData\Local\Temp\88CE.tmp"75⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\894B.tmp"C:\Users\Admin\AppData\Local\Temp\894B.tmp"76⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\89E7.tmp"C:\Users\Admin\AppData\Local\Temp\89E7.tmp"77⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\8A73.tmp"C:\Users\Admin\AppData\Local\Temp\8A73.tmp"78⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"79⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"80⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\8C19.tmp"C:\Users\Admin\AppData\Local\Temp\8C19.tmp"81⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\8D52.tmp"C:\Users\Admin\AppData\Local\Temp\8D52.tmp"83⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\8DEE.tmp"C:\Users\Admin\AppData\Local\Temp\8DEE.tmp"84⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"85⤵PID:5512
-
C:\Users\Admin\AppData\Local\Temp\8F46.tmp"C:\Users\Admin\AppData\Local\Temp\8F46.tmp"86⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\8FE2.tmp"C:\Users\Admin\AppData\Local\Temp\8FE2.tmp"87⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\908E.tmp"C:\Users\Admin\AppData\Local\Temp\908E.tmp"88⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\910B.tmp"C:\Users\Admin\AppData\Local\Temp\910B.tmp"89⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\9178.tmp"C:\Users\Admin\AppData\Local\Temp\9178.tmp"90⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\9205.tmp"C:\Users\Admin\AppData\Local\Temp\9205.tmp"91⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\92B1.tmp"C:\Users\Admin\AppData\Local\Temp\92B1.tmp"92⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\935D.tmp"C:\Users\Admin\AppData\Local\Temp\935D.tmp"93⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\93F9.tmp"C:\Users\Admin\AppData\Local\Temp\93F9.tmp"94⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\94A5.tmp"C:\Users\Admin\AppData\Local\Temp\94A5.tmp"95⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\9541.tmp"C:\Users\Admin\AppData\Local\Temp\9541.tmp"96⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\95BE.tmp"C:\Users\Admin\AppData\Local\Temp\95BE.tmp"97⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\964B.tmp"C:\Users\Admin\AppData\Local\Temp\964B.tmp"98⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\96E7.tmp"C:\Users\Admin\AppData\Local\Temp\96E7.tmp"99⤵PID:5776
-
C:\Users\Admin\AppData\Local\Temp\9764.tmp"C:\Users\Admin\AppData\Local\Temp\9764.tmp"100⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\97E1.tmp"C:\Users\Admin\AppData\Local\Temp\97E1.tmp"101⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\989C.tmp"C:\Users\Admin\AppData\Local\Temp\989C.tmp"102⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\9929.tmp"C:\Users\Admin\AppData\Local\Temp\9929.tmp"103⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\99A6.tmp"C:\Users\Admin\AppData\Local\Temp\99A6.tmp"104⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\9A42.tmp"C:\Users\Admin\AppData\Local\Temp\9A42.tmp"105⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\9ACF.tmp"C:\Users\Admin\AppData\Local\Temp\9ACF.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\9B7B.tmp"C:\Users\Admin\AppData\Local\Temp\9B7B.tmp"107⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\9C07.tmp"C:\Users\Admin\AppData\Local\Temp\9C07.tmp"108⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\9C94.tmp"C:\Users\Admin\AppData\Local\Temp\9C94.tmp"109⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\9D50.tmp"C:\Users\Admin\AppData\Local\Temp\9D50.tmp"110⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\9DDC.tmp"C:\Users\Admin\AppData\Local\Temp\9DDC.tmp"111⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\9E78.tmp"C:\Users\Admin\AppData\Local\Temp\9E78.tmp"112⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\9EF5.tmp"C:\Users\Admin\AppData\Local\Temp\9EF5.tmp"113⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"114⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\A01E.tmp"C:\Users\Admin\AppData\Local\Temp\A01E.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\A0CA.tmp"C:\Users\Admin\AppData\Local\Temp\A0CA.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\A1A5.tmp"C:\Users\Admin\AppData\Local\Temp\A1A5.tmp"117⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\A222.tmp"C:\Users\Admin\AppData\Local\Temp\A222.tmp"118⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\A29F.tmp"C:\Users\Admin\AppData\Local\Temp\A29F.tmp"119⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\A32C.tmp"C:\Users\Admin\AppData\Local\Temp\A32C.tmp"120⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"121⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\A454.tmp"C:\Users\Admin\AppData\Local\Temp\A454.tmp"122⤵PID:3392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-