Analysis
- max time kernel
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 16:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_d706415347c227fdedee1ce76367fd5b_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_d706415347c227fdedee1ce76367fd5b_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-31_d706415347c227fdedee1ce76367fd5b_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260731-t2s19axygs
- SHA256 16fe3d34c6ddf87d946aa1c557117018b02e7281a24348341e1740045492755f
- MD5 d706415347c227fdedee1ce76367fd5b
- SHA1 8be656e9667577bbe7eec03ee0ddaf442cafb575
- SHA512 99a0269c09b9bb4f7e3f2ab5fe5d60d895ad415b5bd0a5ca0430e6de10e2f4f798cab3b69db3cb295228d8b062e89975b9b389071693c76a796ef474bc4dbe9d
- SSDEEP 12288:NU5rCOTeijo5zwfPmcrrrWhtLTZwlH4Hp:NUQOJjOwn5rHQtLTSlH4Hp
- TLSH T132B4E125B689C133E69201710AE6D7A22A3F7D311766A4C33B94623E2FB67E1D375343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4396 6603.tmp 1520 671D.tmp 5624 67B9.tmp 3928 6874.tmp 2732 6911.tmp 5368 69EB.tmp 3692 6AB6.tmp 5156 6BB0.tmp 5012 6C8B.tmp 1388 6D27.tmp 5560 6DA4.tmp 4828 6E8F.tmp 1104 6F79.tmp 1236 7025.tmp 5836 70E1.tmp 820 717D.tmp 4196 7209.tmp 3796 72D5.tmp 3388 73DE.tmp 5920 748A.tmp 4200 7526.tmp 1872 75D2.tmp 5800 767E.tmp 2872 773A.tmp 5100 77D6.tmp 6128 78A1.tmp 1924 796C.tmp 960 7A76.tmp 1308 7B60.tmp 964 7C0C.tmp 5736 7CB8.tmp 1556 7D83.tmp 548 7E1F.tmp 2124 7EAC.tmp 1580 7F29.tmp 5504 7FC5.tmp 4844 8042.tmp 2696 80BF.tmp 2544 815B.tmp 2828 8226.tmp 4912 82C3.tmp 4792 835F.tmp 4632 83EC.tmp 5532 8478.tmp 5860 8514.tmp 6088 8591.tmp 1300 861E.tmp 3060 869B.tmp 3716 8747.tmp 4820 87C4.tmp 3332 8831.tmp 4768 88ED.tmp 2328 896A.tmp 1684 89D7.tmp 3836 8A54.tmp 4188 8AF0.tmp 3104 8B7D.tmp 3556 8BFA.tmp 2532 8C96.tmp 5784 8D33.tmp 4688 8DBF.tmp 1164 8E3C.tmp 4384 8F07.tmp 3448 8F94.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4969.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 440F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 667C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2632.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 418E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F284.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B05B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 474B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 660E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8118.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F38E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 896A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B28D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D680.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 519C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D008.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A28B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B528.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 911B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 734D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8473.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E49.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4924 wrote to memory of 4396 4924 2026-07-31_d706415347c227fdedee1ce76367fd5b_elex_mafia_stealc_tofsee.exe 89 PID 4396 wrote to memory of 1520 4396 6603.tmp 90 PID 1520 wrote to memory of 5624 1520 671D.tmp 91 PID 5624 wrote to memory of 3928 5624 67B9.tmp 92 PID 3928 wrote to memory of 2732 3928 6874.tmp 93 PID 2732 wrote to memory of 5368 2732 6911.tmp 94 PID 5368 wrote to memory of 3692 5368 69EB.tmp 95 PID 3692 wrote to memory of 5156 3692 6AB6.tmp 96 PID 5156 wrote to memory of 5012 5156 6BB0.tmp 97 PID 5012 wrote to memory of 1388 5012 6C8B.tmp 98 PID 1388 wrote to memory of 5560 1388 6D27.tmp 99 PID 5560 wrote to memory of 4828 5560 6DA4.tmp 100 PID 4828 wrote to memory of 1104 4828 6E8F.tmp 101 PID 1104 wrote to memory of 1236 1104 6F79.tmp 102 PID 1236 wrote to memory of 5836 1236 7025.tmp 103 PID 5836 wrote to memory of 820 5836 70E1.tmp 104 PID 820 wrote to memory of 4196 820 717D.tmp 105 PID 4196 wrote to memory of 3796 4196 7209.tmp 106 PID 3796 wrote to memory of 3388 3796 72D5.tmp 107 PID 3388 wrote to memory of 5920 3388 73DE.tmp 108 PID 5920 wrote to memory of 4200 5920 748A.tmp 109 PID 4200 wrote to memory of 1872 4200 7526.tmp 110 PID 1872 wrote to memory of 5800 1872 75D2.tmp 111 PID 5800 wrote to memory of 2872 5800 767E.tmp 112 PID 2872 wrote to memory of 5100 2872 773A.tmp 113 PID 5100 wrote to memory of 6128 5100 77D6.tmp 114 PID 6128 wrote to memory of 1924 6128 78A1.tmp 115 PID 1924 wrote to memory of 960 1924 796C.tmp 116 PID 960 wrote to memory of 1308 960 7A76.tmp 117 PID 1308 wrote to memory of 964 1308 7B60.tmp 118 PID 964 wrote to memory of 5736 964 7C0C.tmp 119 PID 5736 wrote to memory of 1556 5736 7CB8.tmp 120 PID 1556 wrote to memory of 548 1556 7D83.tmp 121 PID 548 wrote to memory of 2124 548 7E1F.tmp 122 PID 2124 wrote to memory of 1580 2124 7EAC.tmp 123 PID 1580 wrote to memory of 5504 1580 7F29.tmp 124 PID 5504 wrote to memory of 4844 5504 7FC5.tmp 125 PID 4844 wrote to memory of 2696 4844 8042.tmp 126 PID 2696 wrote to memory of 2544 2696 80BF.tmp 127 PID 2544 wrote to memory of 2828 2544 815B.tmp 128 PID 2828 wrote to memory of 4912 2828 8226.tmp 129 PID 4912 wrote to memory of 4792 4912 82C3.tmp 130 PID 4792 wrote to memory of 4632 4792 835F.tmp 131 PID 4632 wrote to memory of 5532 4632 83EC.tmp 132 PID 5532 wrote to memory of 5860 5532 8478.tmp 133 PID 5860 wrote to memory of 6088 5860 8514.tmp 134 PID 6088 wrote to memory of 1300 6088 8591.tmp 135 PID 1300 wrote to memory of 3060 1300 861E.tmp 136 PID 3060 wrote to memory of 3716 3060 869B.tmp 137 PID 3716 wrote to memory of 4820 3716 8747.tmp 138 PID 4820 wrote to memory of 3332 4820 87C4.tmp 139 PID 3332 wrote to memory of 4768 3332 8831.tmp 140 PID 4768 wrote to memory of 2328 4768 88ED.tmp 141 PID 2328 wrote to memory of 1684 2328 896A.tmp 142 PID 1684 wrote to memory of 3836 1684 89D7.tmp 143 PID 3836 wrote to memory of 4188 3836 8A54.tmp 144 PID 4188 wrote to memory of 3104 4188 8AF0.tmp 145 PID 3104 wrote to memory of 3556 3104 8B7D.tmp 146 PID 3556 wrote to memory of 2532 3556 8BFA.tmp 147 PID 2532 wrote to memory of 5784 2532 8C96.tmp 148 PID 5784 wrote to memory of 4688 5784 8D33.tmp 149 PID 4688 wrote to memory of 1164 4688 8DBF.tmp 150 PID 1164 wrote to memory of 4384 1164 8E3C.tmp 151 PID 4384 wrote to memory of 3448 4384 8F07.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_d706415347c227fdedee1ce76367fd5b_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_d706415347c227fdedee1ce76367fd5b_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\6603.tmp"C:\Users\Admin\AppData\Local\Temp\6603.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\671D.tmp"C:\Users\Admin\AppData\Local\Temp\671D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\67B9.tmp"C:\Users\Admin\AppData\Local\Temp\67B9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\6874.tmp"C:\Users\Admin\AppData\Local\Temp\6874.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\6911.tmp"C:\Users\Admin\AppData\Local\Temp\6911.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\69EB.tmp"C:\Users\Admin\AppData\Local\Temp\69EB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\6AB6.tmp"C:\Users\Admin\AppData\Local\Temp\6AB6.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\6BB0.tmp"C:\Users\Admin\AppData\Local\Temp\6BB0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\6C8B.tmp"C:\Users\Admin\AppData\Local\Temp\6C8B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\6D27.tmp"C:\Users\Admin\AppData\Local\Temp\6D27.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\6DA4.tmp"C:\Users\Admin\AppData\Local\Temp\6DA4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Users\Admin\AppData\Local\Temp\6E8F.tmp"C:\Users\Admin\AppData\Local\Temp\6E8F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\6F79.tmp"C:\Users\Admin\AppData\Local\Temp\6F79.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\7025.tmp"C:\Users\Admin\AppData\Local\Temp\7025.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\70E1.tmp"C:\Users\Admin\AppData\Local\Temp\70E1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\717D.tmp"C:\Users\Admin\AppData\Local\Temp\717D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\7209.tmp"C:\Users\Admin\AppData\Local\Temp\7209.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\72D5.tmp"C:\Users\Admin\AppData\Local\Temp\72D5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\73DE.tmp"C:\Users\Admin\AppData\Local\Temp\73DE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\748A.tmp"C:\Users\Admin\AppData\Local\Temp\748A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\7526.tmp"C:\Users\Admin\AppData\Local\Temp\7526.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\75D2.tmp"C:\Users\Admin\AppData\Local\Temp\75D2.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\767E.tmp"C:\Users\Admin\AppData\Local\Temp\767E.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\773A.tmp"C:\Users\Admin\AppData\Local\Temp\773A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\77D6.tmp"C:\Users\Admin\AppData\Local\Temp\77D6.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\78A1.tmp"C:\Users\Admin\AppData\Local\Temp\78A1.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\796C.tmp"C:\Users\Admin\AppData\Local\Temp\796C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\7A76.tmp"C:\Users\Admin\AppData\Local\Temp\7A76.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\7B60.tmp"C:\Users\Admin\AppData\Local\Temp\7B60.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\7CB8.tmp"C:\Users\Admin\AppData\Local\Temp\7CB8.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\7D83.tmp"C:\Users\Admin\AppData\Local\Temp\7D83.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\7E1F.tmp"C:\Users\Admin\AppData\Local\Temp\7E1F.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\7EAC.tmp"C:\Users\Admin\AppData\Local\Temp\7EAC.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\7F29.tmp"C:\Users\Admin\AppData\Local\Temp\7F29.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\7FC5.tmp"C:\Users\Admin\AppData\Local\Temp\7FC5.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\8042.tmp"C:\Users\Admin\AppData\Local\Temp\8042.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\80BF.tmp"C:\Users\Admin\AppData\Local\Temp\80BF.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\815B.tmp"C:\Users\Admin\AppData\Local\Temp\815B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\8226.tmp"C:\Users\Admin\AppData\Local\Temp\8226.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\82C3.tmp"C:\Users\Admin\AppData\Local\Temp\82C3.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\835F.tmp"C:\Users\Admin\AppData\Local\Temp\835F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\83EC.tmp"C:\Users\Admin\AppData\Local\Temp\83EC.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\8478.tmp"C:\Users\Admin\AppData\Local\Temp\8478.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\8514.tmp"C:\Users\Admin\AppData\Local\Temp\8514.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\8591.tmp"C:\Users\Admin\AppData\Local\Temp\8591.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\861E.tmp"C:\Users\Admin\AppData\Local\Temp\861E.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\869B.tmp"C:\Users\Admin\AppData\Local\Temp\869B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\8747.tmp"C:\Users\Admin\AppData\Local\Temp\8747.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\87C4.tmp"C:\Users\Admin\AppData\Local\Temp\87C4.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\8831.tmp"C:\Users\Admin\AppData\Local\Temp\8831.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\88ED.tmp"C:\Users\Admin\AppData\Local\Temp\88ED.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\896A.tmp"C:\Users\Admin\AppData\Local\Temp\896A.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\89D7.tmp"C:\Users\Admin\AppData\Local\Temp\89D7.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\8A54.tmp"C:\Users\Admin\AppData\Local\Temp\8A54.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\8D33.tmp"C:\Users\Admin\AppData\Local\Temp\8D33.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\8E3C.tmp"C:\Users\Admin\AppData\Local\Temp\8E3C.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\8F07.tmp"C:\Users\Admin\AppData\Local\Temp\8F07.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\8F94.tmp"C:\Users\Admin\AppData\Local\Temp\8F94.tmp"65⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\9011.tmp"C:\Users\Admin\AppData\Local\Temp\9011.tmp"66⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\909E.tmp"C:\Users\Admin\AppData\Local\Temp\909E.tmp"67⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\911B.tmp"C:\Users\Admin\AppData\Local\Temp\911B.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:5276 -
C:\Users\Admin\AppData\Local\Temp\9188.tmp"C:\Users\Admin\AppData\Local\Temp\9188.tmp"69⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\9215.tmp"C:\Users\Admin\AppData\Local\Temp\9215.tmp"70⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\9292.tmp"C:\Users\Admin\AppData\Local\Temp\9292.tmp"71⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\933D.tmp"C:\Users\Admin\AppData\Local\Temp\933D.tmp"72⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\93BA.tmp"C:\Users\Admin\AppData\Local\Temp\93BA.tmp"73⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\9437.tmp"C:\Users\Admin\AppData\Local\Temp\9437.tmp"74⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\94E3.tmp"C:\Users\Admin\AppData\Local\Temp\94E3.tmp"75⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\95AE.tmp"C:\Users\Admin\AppData\Local\Temp\95AE.tmp"76⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\962B.tmp"C:\Users\Admin\AppData\Local\Temp\962B.tmp"77⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\96C8.tmp"C:\Users\Admin\AppData\Local\Temp\96C8.tmp"78⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\9745.tmp"C:\Users\Admin\AppData\Local\Temp\9745.tmp"79⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\97D1.tmp"C:\Users\Admin\AppData\Local\Temp\97D1.tmp"80⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\985E.tmp"C:\Users\Admin\AppData\Local\Temp\985E.tmp"81⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\98EB.tmp"C:\Users\Admin\AppData\Local\Temp\98EB.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\9977.tmp"C:\Users\Admin\AppData\Local\Temp\9977.tmp"83⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\9A13.tmp"C:\Users\Admin\AppData\Local\Temp\9A13.tmp"84⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"85⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"C:\Users\Admin\AppData\Local\Temp\9B4C.tmp"86⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\9BC9.tmp"C:\Users\Admin\AppData\Local\Temp\9BC9.tmp"87⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\9C36.tmp"C:\Users\Admin\AppData\Local\Temp\9C36.tmp"88⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"C:\Users\Admin\AppData\Local\Temp\9CB3.tmp"89⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\9D40.tmp"C:\Users\Admin\AppData\Local\Temp\9D40.tmp"90⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\9DDC.tmp"C:\Users\Admin\AppData\Local\Temp\9DDC.tmp"91⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\9E59.tmp"C:\Users\Admin\AppData\Local\Temp\9E59.tmp"92⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\9ED6.tmp"C:\Users\Admin\AppData\Local\Temp\9ED6.tmp"93⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\9F53.tmp"C:\Users\Admin\AppData\Local\Temp\9F53.tmp"94⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\9FE0.tmp"C:\Users\Admin\AppData\Local\Temp\9FE0.tmp"95⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\A05D.tmp"C:\Users\Admin\AppData\Local\Temp\A05D.tmp"96⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\A0DA.tmp"C:\Users\Admin\AppData\Local\Temp\A0DA.tmp"97⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\A157.tmp"C:\Users\Admin\AppData\Local\Temp\A157.tmp"98⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"99⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\A29F.tmp"C:\Users\Admin\AppData\Local\Temp\A29F.tmp"100⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\A33B.tmp"C:\Users\Admin\AppData\Local\Temp\A33B.tmp"101⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"C:\Users\Admin\AppData\Local\Temp\A3D7.tmp"102⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\A474.tmp"C:\Users\Admin\AppData\Local\Temp\A474.tmp"103⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\A510.tmp"C:\Users\Admin\AppData\Local\Temp\A510.tmp"104⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\A5AC.tmp"C:\Users\Admin\AppData\Local\Temp\A5AC.tmp"105⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\A648.tmp"C:\Users\Admin\AppData\Local\Temp\A648.tmp"106⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\A6F4.tmp"C:\Users\Admin\AppData\Local\Temp\A6F4.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\A781.tmp"C:\Users\Admin\AppData\Local\Temp\A781.tmp"108⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\A7EE.tmp"C:\Users\Admin\AppData\Local\Temp\A7EE.tmp"109⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\A88B.tmp"C:\Users\Admin\AppData\Local\Temp\A88B.tmp"110⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\A908.tmp"C:\Users\Admin\AppData\Local\Temp\A908.tmp"111⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\A985.tmp"C:\Users\Admin\AppData\Local\Temp\A985.tmp"112⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\AA02.tmp"C:\Users\Admin\AppData\Local\Temp\AA02.tmp"113⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\AA6F.tmp"C:\Users\Admin\AppData\Local\Temp\AA6F.tmp"114⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\AADC.tmp"C:\Users\Admin\AppData\Local\Temp\AADC.tmp"115⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\AB69.tmp"C:\Users\Admin\AppData\Local\Temp\AB69.tmp"116⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\ABD6.tmp"C:\Users\Admin\AppData\Local\Temp\ABD6.tmp"117⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\AC53.tmp"C:\Users\Admin\AppData\Local\Temp\AC53.tmp"118⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\AD0F.tmp"C:\Users\Admin\AppData\Local\Temp\AD0F.tmp"119⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\AD8C.tmp"C:\Users\Admin\AppData\Local\Temp\AD8C.tmp"120⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\AE28.tmp"C:\Users\Admin\AppData\Local\Temp\AE28.tmp"121⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\AEA5.tmp"C:\Users\Admin\AppData\Local\Temp\AEA5.tmp"122⤵PID:4640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-