Analysis
- max time kernel
126s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 07:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_51e2bb710ce39971a24060688bf3eb73_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_51e2bb710ce39971a24060688bf3eb73_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-14_51e2bb710ce39971a24060688bf3eb73_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260814-jvbtaafm71
- SHA256 172655964cc4ece7aeadd74dcbe730206853fab8c67f3db6de006f66b3fcbbaa
- MD5 51e2bb710ce39971a24060688bf3eb73
- SHA1 099a4833bd8f65ec864ac45bc6b44b2f25886cb4
- SHA512 e1c23a6ecb90dd82dd874f73a6f054a2b28c7430f7d1e62f202923b2a77cad74beec8d96c43660d26eb92f1c4895be4fbb6dd9eebe19ded4023e4e60eac04996
- SSDEEP 12288:HU5rCOTeiJ4Z2Ka+ApiN7o/DAyH4GwisKNZ:HUQOJJ4Z2K0pilo/DAyH4ON
- TLSH T12FB4F0227485C432E1E202344EE6EBB1693A7D31972264C37B947A7E6FB13E1E774346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2768 5E33.tmp 2772 5F0E.tmp 2652 5FAA.tmp 4164 6047.tmp 2440 60C4.tmp 5068 618F.tmp 3104 623B.tmp 3020 62D7.tmp 3932 6383.tmp 1728 646D.tmp 5712 6548.tmp 404 6603.tmp 4916 6680.tmp 2832 66FD.tmp 4996 67D8.tmp 6008 68A3.tmp 4832 693F.tmp 4256 69BC.tmp 3176 6A88.tmp 3308 6B14.tmp 2664 6B91.tmp 5808 6C7C.tmp 944 6CF9.tmp 4556 6DA4.tmp 2892 6E31.tmp 1140 6EFC.tmp 3472 6F98.tmp 2792 7083.tmp 1388 712F.tmp 2824 7209.tmp 3128 72E4.tmp 2716 7380.tmp 2136 740D.tmp 1672 747A.tmp 6104 74F7.tmp 4432 7594.tmp 2852 7611.tmp 4984 766E.tmp 4224 76FB.tmp 4672 7768.tmp 2928 77D6.tmp 5004 7872.tmp 4776 78FF.tmp 5076 797C.tmp 4448 79F9.tmp 628 7A85.tmp 1292 7B12.tmp 2912 7B7F.tmp 2388 7C0C.tmp 5932 7CA8.tmp 3928 7D25.tmp 5660 7D93.tmp 4920 7E00.tmp 4660 7E7D.tmp 2476 7EFA.tmp 3352 7F77.tmp 3680 7FE4.tmp 5952 80A0.tmp 5336 811D.tmp 2224 818A.tmp 4516 81F8.tmp 1408 8255.tmp 5764 82C3.tmp 3536 8330.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 985E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A985.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DCF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F236.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A114.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D090.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2348.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1440.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 868B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 177C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1128.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8157.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6603.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E40D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A147.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 859C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C402.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3535.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D325.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E584.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ECF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A20E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9CE.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1784 wrote to memory of 2768 1784 2026-08-14_51e2bb710ce39971a24060688bf3eb73_elex_mafia_stealc_tofsee.exe 89 PID 2768 wrote to memory of 2772 2768 5E33.tmp 90 PID 2772 wrote to memory of 2652 2772 5F0E.tmp 91 PID 2652 wrote to memory of 4164 2652 5FAA.tmp 92 PID 4164 wrote to memory of 2440 4164 6047.tmp 93 PID 2440 wrote to memory of 5068 2440 60C4.tmp 94 PID 5068 wrote to memory of 3104 5068 618F.tmp 95 PID 3104 wrote to memory of 3020 3104 623B.tmp 96 PID 3020 wrote to memory of 3932 3020 62D7.tmp 97 PID 3932 wrote to memory of 1728 3932 6383.tmp 98 PID 1728 wrote to memory of 5712 1728 646D.tmp 99 PID 5712 wrote to memory of 404 5712 6548.tmp 100 PID 404 wrote to memory of 4916 404 6603.tmp 101 PID 4916 wrote to memory of 2832 4916 6680.tmp 102 PID 2832 wrote to memory of 4996 2832 66FD.tmp 103 PID 4996 wrote to memory of 6008 4996 67D8.tmp 104 PID 6008 wrote to memory of 4832 6008 68A3.tmp 105 PID 4832 wrote to memory of 4256 4832 693F.tmp 106 PID 4256 wrote to memory of 3176 4256 69BC.tmp 107 PID 3176 wrote to memory of 3308 3176 6A88.tmp 108 PID 3308 wrote to memory of 2664 3308 6B14.tmp 109 PID 2664 wrote to memory of 5808 2664 6B91.tmp 110 PID 5808 wrote to memory of 944 5808 6C7C.tmp 111 PID 944 wrote to memory of 4556 944 6CF9.tmp 112 PID 4556 wrote to memory of 2892 4556 6DA4.tmp 113 PID 2892 wrote to memory of 1140 2892 6E31.tmp 114 PID 1140 wrote to memory of 3472 1140 6EFC.tmp 115 PID 3472 wrote to memory of 2792 3472 6F98.tmp 116 PID 2792 wrote to memory of 1388 2792 7083.tmp 117 PID 1388 wrote to memory of 2824 1388 712F.tmp 118 PID 2824 wrote to memory of 3128 2824 7209.tmp 119 PID 3128 wrote to memory of 2716 3128 72E4.tmp 120 PID 2716 wrote to memory of 2136 2716 7380.tmp 121 PID 2136 wrote to memory of 1672 2136 740D.tmp 122 PID 1672 wrote to memory of 6104 1672 747A.tmp 123 PID 6104 wrote to memory of 4432 6104 74F7.tmp 124 PID 4432 wrote to memory of 2852 4432 7594.tmp 125 PID 2852 wrote to memory of 4984 2852 7611.tmp 126 PID 4984 wrote to memory of 4224 4984 766E.tmp 127 PID 4224 wrote to memory of 4672 4224 76FB.tmp 128 PID 4672 wrote to memory of 2928 4672 7768.tmp 129 PID 2928 wrote to memory of 5004 2928 77D6.tmp 130 PID 5004 wrote to memory of 4776 5004 7872.tmp 131 PID 4776 wrote to memory of 5076 4776 78FF.tmp 132 PID 5076 wrote to memory of 4448 5076 797C.tmp 133 PID 4448 wrote to memory of 628 4448 79F9.tmp 134 PID 628 wrote to memory of 1292 628 7A85.tmp 135 PID 1292 wrote to memory of 2912 1292 7B12.tmp 136 PID 2912 wrote to memory of 2388 2912 7B7F.tmp 137 PID 2388 wrote to memory of 5932 2388 7C0C.tmp 138 PID 5932 wrote to memory of 3928 5932 7CA8.tmp 139 PID 3928 wrote to memory of 5660 3928 7D25.tmp 140 PID 5660 wrote to memory of 4920 5660 7D93.tmp 141 PID 4920 wrote to memory of 4660 4920 7E00.tmp 142 PID 4660 wrote to memory of 2476 4660 7E7D.tmp 143 PID 2476 wrote to memory of 3352 2476 7EFA.tmp 144 PID 3352 wrote to memory of 3680 3352 7F77.tmp 145 PID 3680 wrote to memory of 5952 3680 7FE4.tmp 146 PID 5952 wrote to memory of 5336 5952 80A0.tmp 147 PID 5336 wrote to memory of 2224 5336 811D.tmp 148 PID 2224 wrote to memory of 4516 2224 818A.tmp 149 PID 4516 wrote to memory of 1408 4516 81F8.tmp 150 PID 1408 wrote to memory of 5764 1408 8255.tmp 151 PID 5764 wrote to memory of 3536 5764 82C3.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_51e2bb710ce39971a24060688bf3eb73_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_51e2bb710ce39971a24060688bf3eb73_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\5E33.tmp"C:\Users\Admin\AppData\Local\Temp\5E33.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\5F0E.tmp"C:\Users\Admin\AppData\Local\Temp\5F0E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\5FAA.tmp"C:\Users\Admin\AppData\Local\Temp\5FAA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\6047.tmp"C:\Users\Admin\AppData\Local\Temp\6047.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\60C4.tmp"C:\Users\Admin\AppData\Local\Temp\60C4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\618F.tmp"C:\Users\Admin\AppData\Local\Temp\618F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\623B.tmp"C:\Users\Admin\AppData\Local\Temp\623B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\62D7.tmp"C:\Users\Admin\AppData\Local\Temp\62D7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\6383.tmp"C:\Users\Admin\AppData\Local\Temp\6383.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\646D.tmp"C:\Users\Admin\AppData\Local\Temp\646D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\6603.tmp"C:\Users\Admin\AppData\Local\Temp\6603.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\66FD.tmp"C:\Users\Admin\AppData\Local\Temp\66FD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\67D8.tmp"C:\Users\Admin\AppData\Local\Temp\67D8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\68A3.tmp"C:\Users\Admin\AppData\Local\Temp\68A3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\693F.tmp"C:\Users\Admin\AppData\Local\Temp\693F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\69BC.tmp"C:\Users\Admin\AppData\Local\Temp\69BC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\6A88.tmp"C:\Users\Admin\AppData\Local\Temp\6A88.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\6B14.tmp"C:\Users\Admin\AppData\Local\Temp\6B14.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\6B91.tmp"C:\Users\Admin\AppData\Local\Temp\6B91.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\6C7C.tmp"C:\Users\Admin\AppData\Local\Temp\6C7C.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\6CF9.tmp"C:\Users\Admin\AppData\Local\Temp\6CF9.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\6DA4.tmp"C:\Users\Admin\AppData\Local\Temp\6DA4.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\6E31.tmp"C:\Users\Admin\AppData\Local\Temp\6E31.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\6EFC.tmp"C:\Users\Admin\AppData\Local\Temp\6EFC.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\6F98.tmp"C:\Users\Admin\AppData\Local\Temp\6F98.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\7083.tmp"C:\Users\Admin\AppData\Local\Temp\7083.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\712F.tmp"C:\Users\Admin\AppData\Local\Temp\712F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\7209.tmp"C:\Users\Admin\AppData\Local\Temp\7209.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\72E4.tmp"C:\Users\Admin\AppData\Local\Temp\72E4.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\7380.tmp"C:\Users\Admin\AppData\Local\Temp\7380.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\740D.tmp"C:\Users\Admin\AppData\Local\Temp\740D.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\747A.tmp"C:\Users\Admin\AppData\Local\Temp\747A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\74F7.tmp"C:\Users\Admin\AppData\Local\Temp\74F7.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\7594.tmp"C:\Users\Admin\AppData\Local\Temp\7594.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\7611.tmp"C:\Users\Admin\AppData\Local\Temp\7611.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\766E.tmp"C:\Users\Admin\AppData\Local\Temp\766E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\76FB.tmp"C:\Users\Admin\AppData\Local\Temp\76FB.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\7768.tmp"C:\Users\Admin\AppData\Local\Temp\7768.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\77D6.tmp"C:\Users\Admin\AppData\Local\Temp\77D6.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\7872.tmp"C:\Users\Admin\AppData\Local\Temp\7872.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\78FF.tmp"C:\Users\Admin\AppData\Local\Temp\78FF.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\797C.tmp"C:\Users\Admin\AppData\Local\Temp\797C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\79F9.tmp"C:\Users\Admin\AppData\Local\Temp\79F9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\7A85.tmp"C:\Users\Admin\AppData\Local\Temp\7A85.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\7B12.tmp"C:\Users\Admin\AppData\Local\Temp\7B12.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\7D25.tmp"C:\Users\Admin\AppData\Local\Temp\7D25.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\7D93.tmp"C:\Users\Admin\AppData\Local\Temp\7D93.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\7E00.tmp"C:\Users\Admin\AppData\Local\Temp\7E00.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\7EFA.tmp"C:\Users\Admin\AppData\Local\Temp\7EFA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\7F77.tmp"C:\Users\Admin\AppData\Local\Temp\7F77.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\80A0.tmp"C:\Users\Admin\AppData\Local\Temp\80A0.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\811D.tmp"C:\Users\Admin\AppData\Local\Temp\811D.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\818A.tmp"C:\Users\Admin\AppData\Local\Temp\818A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\81F8.tmp"C:\Users\Admin\AppData\Local\Temp\81F8.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\8255.tmp"C:\Users\Admin\AppData\Local\Temp\8255.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\82C3.tmp"C:\Users\Admin\AppData\Local\Temp\82C3.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\8330.tmp"C:\Users\Admin\AppData\Local\Temp\8330.tmp"65⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\83AD.tmp"C:\Users\Admin\AppData\Local\Temp\83AD.tmp"66⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\841A.tmp"C:\Users\Admin\AppData\Local\Temp\841A.tmp"67⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\8497.tmp"C:\Users\Admin\AppData\Local\Temp\8497.tmp"68⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\8524.tmp"C:\Users\Admin\AppData\Local\Temp\8524.tmp"69⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\8591.tmp"C:\Users\Admin\AppData\Local\Temp\8591.tmp"70⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\85FF.tmp"C:\Users\Admin\AppData\Local\Temp\85FF.tmp"71⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\868B.tmp"C:\Users\Admin\AppData\Local\Temp\868B.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\8718.tmp"C:\Users\Admin\AppData\Local\Temp\8718.tmp"73⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\8785.tmp"C:\Users\Admin\AppData\Local\Temp\8785.tmp"74⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\8802.tmp"C:\Users\Admin\AppData\Local\Temp\8802.tmp"75⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\887F.tmp"C:\Users\Admin\AppData\Local\Temp\887F.tmp"76⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\88ED.tmp"C:\Users\Admin\AppData\Local\Temp\88ED.tmp"77⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\895A.tmp"C:\Users\Admin\AppData\Local\Temp\895A.tmp"78⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\89E7.tmp"C:\Users\Admin\AppData\Local\Temp\89E7.tmp"79⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\8A54.tmp"C:\Users\Admin\AppData\Local\Temp\8A54.tmp"80⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\8AD1.tmp"C:\Users\Admin\AppData\Local\Temp\8AD1.tmp"81⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"82⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"83⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\8C48.tmp"C:\Users\Admin\AppData\Local\Temp\8C48.tmp"84⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"85⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"86⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"88⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\8F55.tmp"C:\Users\Admin\AppData\Local\Temp\8F55.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\9040.tmp"C:\Users\Admin\AppData\Local\Temp\9040.tmp"91⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\90CC.tmp"C:\Users\Admin\AppData\Local\Temp\90CC.tmp"92⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\9149.tmp"C:\Users\Admin\AppData\Local\Temp\9149.tmp"93⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\91A7.tmp"C:\Users\Admin\AppData\Local\Temp\91A7.tmp"94⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\9224.tmp"C:\Users\Admin\AppData\Local\Temp\9224.tmp"95⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\92A1.tmp"C:\Users\Admin\AppData\Local\Temp\92A1.tmp"96⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\932E.tmp"C:\Users\Admin\AppData\Local\Temp\932E.tmp"97⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\93BA.tmp"C:\Users\Admin\AppData\Local\Temp\93BA.tmp"98⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\9437.tmp"C:\Users\Admin\AppData\Local\Temp\9437.tmp"99⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\94E3.tmp"C:\Users\Admin\AppData\Local\Temp\94E3.tmp"100⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\9551.tmp"C:\Users\Admin\AppData\Local\Temp\9551.tmp"101⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\95CE.tmp"C:\Users\Admin\AppData\Local\Temp\95CE.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\965A.tmp"C:\Users\Admin\AppData\Local\Temp\965A.tmp"103⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\96C8.tmp"C:\Users\Admin\AppData\Local\Temp\96C8.tmp"104⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\9764.tmp"C:\Users\Admin\AppData\Local\Temp\9764.tmp"105⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\97E1.tmp"C:\Users\Admin\AppData\Local\Temp\97E1.tmp"106⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\985E.tmp"C:\Users\Admin\AppData\Local\Temp\985E.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:568 -
C:\Users\Admin\AppData\Local\Temp\98CB.tmp"C:\Users\Admin\AppData\Local\Temp\98CB.tmp"108⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\9939.tmp"C:\Users\Admin\AppData\Local\Temp\9939.tmp"109⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\99B6.tmp"C:\Users\Admin\AppData\Local\Temp\99B6.tmp"110⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\9A33.tmp"C:\Users\Admin\AppData\Local\Temp\9A33.tmp"111⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"C:\Users\Admin\AppData\Local\Temp\9AB0.tmp"112⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\9B3C.tmp"C:\Users\Admin\AppData\Local\Temp\9B3C.tmp"113⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"C:\Users\Admin\AppData\Local\Temp\9BB9.tmp"114⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\9C36.tmp"C:\Users\Admin\AppData\Local\Temp\9C36.tmp"115⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"116⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\9D11.tmp"C:\Users\Admin\AppData\Local\Temp\9D11.tmp"117⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\9D9E.tmp"C:\Users\Admin\AppData\Local\Temp\9D9E.tmp"118⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\9E1B.tmp"C:\Users\Admin\AppData\Local\Temp\9E1B.tmp"119⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\9E78.tmp"C:\Users\Admin\AppData\Local\Temp\9E78.tmp"120⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\9EF5.tmp"C:\Users\Admin\AppData\Local\Temp\9EF5.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\9F63.tmp"C:\Users\Admin\AppData\Local\Temp\9F63.tmp"122⤵PID:700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-