Analysis
- max time kernel
150s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 03:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_08ceccc19677a1955b2424605935e52e_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_08ceccc19677a1955b2424605935e52e_elex_mafia_stealc_tofsee.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-15_08ceccc19677a1955b2424605935e52e_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260415-d2dzbsd13p
- SHA256 718335fc90684576a6bd530eb977532f60853e1b4e740d10bb548d24bfe73c99
- MD5 08ceccc19677a1955b2424605935e52e
- SHA1 806d5f442cbb79cf02f6c2b7bcfb9fe14e96dd0e
- SHA512 ec2553b106f4f9c90d08ba8310a35acf33947b27fedb74ae4fa3d2ff07fbb416b673414f3a2698d203863128aff35d1f65fc723c9305cc06f0c132aaead3e9de
- SSDEEP 12288:NU5rCOTeijli8O0vOQuvbbOY/nPeuOQt2w8TZwlH:NUQOJjliFzbOYHewt2w8TSlH
- TLSH T147B4F126B545C132E68302710EE6EBA22A3F7C354726A4C73790667E2FB13E1E775346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2944 4522.tmp 4464 45BE.tmp 2256 462C.tmp 3940 4699.tmp 1168 4707.tmp 3492 4755.tmp 6064 47A3.tmp 5160 482F.tmp 3264 487E.tmp 4920 48FB.tmp 3024 4968.tmp 2892 49D5.tmp 3092 4A43.tmp 5436 4AB0.tmp 808 4B3D.tmp 3584 4BBA.tmp 5456 4C08.tmp 3196 4C75.tmp 4004 4CD3.tmp 2840 4D40.tmp 4632 4D8E.tmp 5472 4E1B.tmp 2784 4E88.tmp 2144 4EF6.tmp 5104 4F54.tmp 6048 4FA2.tmp 4564 500F.tmp 5716 508C.tmp 3588 50F9.tmp 1944 5157.tmp 3004 51B5.tmp 4552 5232.tmp 1112 529F.tmp 5144 52ED.tmp 3984 534B.tmp 1048 53A9.tmp 3524 5407.tmp 5688 5455.tmp 5756 5493.tmp 2884 54E1.tmp 4668 553F.tmp 3988 559D.tmp 2532 55EB.tmp 5540 5649.tmp 3156 56A7.tmp 5328 56F5.tmp 2060 5752.tmp 5324 57A1.tmp 5984 57EF.tmp 5592 584C.tmp 5364 58AA.tmp 1704 5908.tmp 5920 5966.tmp 3376 59B4.tmp 5848 5A02.tmp 5292 5A50.tmp 3100 5A9E.tmp 5268 5AEC.tmp 5404 5B4A.tmp 5652 5BA8.tmp 2736 5C06.tmp 744 5C54.tmp 3184 5CB1.tmp 3336 5D00.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B997.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6680.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 529F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C426.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5683.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5232.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4755.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 193B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D24F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 482F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 930F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 677F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1311.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 508C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B06F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4292 wrote to memory of 2944 4292 2026-04-15_08ceccc19677a1955b2424605935e52e_elex_mafia_stealc_tofsee.exe 79 PID 2944 wrote to memory of 4464 2944 4522.tmp 80 PID 4464 wrote to memory of 2256 4464 45BE.tmp 81 PID 2256 wrote to memory of 3940 2256 462C.tmp 82 PID 3940 wrote to memory of 1168 3940 4699.tmp 83 PID 1168 wrote to memory of 3492 1168 4707.tmp 84 PID 3492 wrote to memory of 6064 3492 4755.tmp 85 PID 6064 wrote to memory of 5160 6064 47A3.tmp 86 PID 5160 wrote to memory of 3264 5160 482F.tmp 87 PID 3264 wrote to memory of 4920 3264 487E.tmp 88 PID 4920 wrote to memory of 3024 4920 48FB.tmp 89 PID 3024 wrote to memory of 2892 3024 4968.tmp 90 PID 2892 wrote to memory of 3092 2892 49D5.tmp 91 PID 3092 wrote to memory of 5436 3092 4A43.tmp 92 PID 5436 wrote to memory of 808 5436 4AB0.tmp 93 PID 808 wrote to memory of 3584 808 4B3D.tmp 94 PID 3584 wrote to memory of 5456 3584 4BBA.tmp 95 PID 5456 wrote to memory of 3196 5456 4C08.tmp 96 PID 3196 wrote to memory of 4004 3196 4C75.tmp 97 PID 4004 wrote to memory of 2840 4004 4CD3.tmp 98 PID 2840 wrote to memory of 4632 2840 4D40.tmp 99 PID 4632 wrote to memory of 5472 4632 4D8E.tmp 100 PID 5472 wrote to memory of 2784 5472 4E1B.tmp 101 PID 2784 wrote to memory of 2144 2784 4E88.tmp 102 PID 2144 wrote to memory of 5104 2144 4EF6.tmp 103 PID 5104 wrote to memory of 6048 5104 4F54.tmp 104 PID 6048 wrote to memory of 4564 6048 4FA2.tmp 105 PID 4564 wrote to memory of 5716 4564 500F.tmp 106 PID 5716 wrote to memory of 3588 5716 508C.tmp 107 PID 3588 wrote to memory of 1944 3588 50F9.tmp 108 PID 1944 wrote to memory of 3004 1944 5157.tmp 109 PID 3004 wrote to memory of 4552 3004 51B5.tmp 110 PID 4552 wrote to memory of 1112 4552 5232.tmp 111 PID 1112 wrote to memory of 5144 1112 529F.tmp 112 PID 5144 wrote to memory of 3984 5144 52ED.tmp 113 PID 3984 wrote to memory of 1048 3984 534B.tmp 114 PID 1048 wrote to memory of 3524 1048 53A9.tmp 115 PID 3524 wrote to memory of 5688 3524 5407.tmp 116 PID 5688 wrote to memory of 5756 5688 5455.tmp 117 PID 5756 wrote to memory of 2884 5756 5493.tmp 118 PID 2884 wrote to memory of 4668 2884 54E1.tmp 119 PID 4668 wrote to memory of 3988 4668 553F.tmp 120 PID 3988 wrote to memory of 2532 3988 559D.tmp 121 PID 2532 wrote to memory of 5540 2532 55EB.tmp 122 PID 5540 wrote to memory of 3156 5540 5649.tmp 123 PID 3156 wrote to memory of 5328 3156 56A7.tmp 124 PID 5328 wrote to memory of 2060 5328 56F5.tmp 125 PID 2060 wrote to memory of 5324 2060 5752.tmp 126 PID 5324 wrote to memory of 5984 5324 57A1.tmp 127 PID 5984 wrote to memory of 5592 5984 57EF.tmp 128 PID 5592 wrote to memory of 5364 5592 584C.tmp 129 PID 5364 wrote to memory of 1704 5364 58AA.tmp 130 PID 1704 wrote to memory of 5920 1704 5908.tmp 131 PID 5920 wrote to memory of 3376 5920 5966.tmp 132 PID 3376 wrote to memory of 5848 3376 59B4.tmp 133 PID 5848 wrote to memory of 5292 5848 5A02.tmp 134 PID 5292 wrote to memory of 3100 5292 5A50.tmp 135 PID 3100 wrote to memory of 5268 3100 5A9E.tmp 136 PID 5268 wrote to memory of 5404 5268 5AEC.tmp 137 PID 5404 wrote to memory of 5652 5404 5B4A.tmp 138 PID 5652 wrote to memory of 2736 5652 5BA8.tmp 139 PID 2736 wrote to memory of 744 2736 5C06.tmp 140 PID 744 wrote to memory of 3184 744 5C54.tmp 141 PID 3184 wrote to memory of 3336 3184 5CB1.tmp 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_08ceccc19677a1955b2424605935e52e_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_08ceccc19677a1955b2424605935e52e_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\4522.tmp"C:\Users\Admin\AppData\Local\Temp\4522.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\45BE.tmp"C:\Users\Admin\AppData\Local\Temp\45BE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\462C.tmp"C:\Users\Admin\AppData\Local\Temp\462C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\4699.tmp"C:\Users\Admin\AppData\Local\Temp\4699.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\4707.tmp"C:\Users\Admin\AppData\Local\Temp\4707.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\4755.tmp"C:\Users\Admin\AppData\Local\Temp\4755.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\47A3.tmp"C:\Users\Admin\AppData\Local\Temp\47A3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\482F.tmp"C:\Users\Admin\AppData\Local\Temp\482F.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\487E.tmp"C:\Users\Admin\AppData\Local\Temp\487E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\48FB.tmp"C:\Users\Admin\AppData\Local\Temp\48FB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\4968.tmp"C:\Users\Admin\AppData\Local\Temp\4968.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\49D5.tmp"C:\Users\Admin\AppData\Local\Temp\49D5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\4A43.tmp"C:\Users\Admin\AppData\Local\Temp\4A43.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\4C08.tmp"C:\Users\Admin\AppData\Local\Temp\4C08.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\4C75.tmp"C:\Users\Admin\AppData\Local\Temp\4C75.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\4CD3.tmp"C:\Users\Admin\AppData\Local\Temp\4CD3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\4D40.tmp"C:\Users\Admin\AppData\Local\Temp\4D40.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\4E88.tmp"C:\Users\Admin\AppData\Local\Temp\4E88.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\4F54.tmp"C:\Users\Admin\AppData\Local\Temp\4F54.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\500F.tmp"C:\Users\Admin\AppData\Local\Temp\500F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\508C.tmp"C:\Users\Admin\AppData\Local\Temp\508C.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\50F9.tmp"C:\Users\Admin\AppData\Local\Temp\50F9.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\5157.tmp"C:\Users\Admin\AppData\Local\Temp\5157.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\51B5.tmp"C:\Users\Admin\AppData\Local\Temp\51B5.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\5232.tmp"C:\Users\Admin\AppData\Local\Temp\5232.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\529F.tmp"C:\Users\Admin\AppData\Local\Temp\529F.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\52ED.tmp"C:\Users\Admin\AppData\Local\Temp\52ED.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\534B.tmp"C:\Users\Admin\AppData\Local\Temp\534B.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\53A9.tmp"C:\Users\Admin\AppData\Local\Temp\53A9.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\5407.tmp"C:\Users\Admin\AppData\Local\Temp\5407.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\5455.tmp"C:\Users\Admin\AppData\Local\Temp\5455.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\5493.tmp"C:\Users\Admin\AppData\Local\Temp\5493.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\54E1.tmp"C:\Users\Admin\AppData\Local\Temp\54E1.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\553F.tmp"C:\Users\Admin\AppData\Local\Temp\553F.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\559D.tmp"C:\Users\Admin\AppData\Local\Temp\559D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\55EB.tmp"C:\Users\Admin\AppData\Local\Temp\55EB.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\5649.tmp"C:\Users\Admin\AppData\Local\Temp\5649.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\56A7.tmp"C:\Users\Admin\AppData\Local\Temp\56A7.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\56F5.tmp"C:\Users\Admin\AppData\Local\Temp\56F5.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\5752.tmp"C:\Users\Admin\AppData\Local\Temp\5752.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\57A1.tmp"C:\Users\Admin\AppData\Local\Temp\57A1.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\57EF.tmp"C:\Users\Admin\AppData\Local\Temp\57EF.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\584C.tmp"C:\Users\Admin\AppData\Local\Temp\584C.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\58AA.tmp"C:\Users\Admin\AppData\Local\Temp\58AA.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\5908.tmp"C:\Users\Admin\AppData\Local\Temp\5908.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\5BA8.tmp"C:\Users\Admin\AppData\Local\Temp\5BA8.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\5C06.tmp"C:\Users\Admin\AppData\Local\Temp\5C06.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\5C54.tmp"C:\Users\Admin\AppData\Local\Temp\5C54.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\5D00.tmp"C:\Users\Admin\AppData\Local\Temp\5D00.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"66⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\5D9C.tmp"C:\Users\Admin\AppData\Local\Temp\5D9C.tmp"67⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\5DEA.tmp"C:\Users\Admin\AppData\Local\Temp\5DEA.tmp"68⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\5E38.tmp"C:\Users\Admin\AppData\Local\Temp\5E38.tmp"69⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\5E86.tmp"C:\Users\Admin\AppData\Local\Temp\5E86.tmp"70⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\5ED4.tmp"C:\Users\Admin\AppData\Local\Temp\5ED4.tmp"71⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\5F22.tmp"C:\Users\Admin\AppData\Local\Temp\5F22.tmp"72⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"73⤵PID:6028
-
C:\Users\Admin\AppData\Local\Temp\5FAF.tmp"C:\Users\Admin\AppData\Local\Temp\5FAF.tmp"74⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\5FFD.tmp"C:\Users\Admin\AppData\Local\Temp\5FFD.tmp"75⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\604B.tmp"C:\Users\Admin\AppData\Local\Temp\604B.tmp"76⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\6099.tmp"C:\Users\Admin\AppData\Local\Temp\6099.tmp"77⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\60E8.tmp"C:\Users\Admin\AppData\Local\Temp\60E8.tmp"78⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\6136.tmp"C:\Users\Admin\AppData\Local\Temp\6136.tmp"79⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\6184.tmp"C:\Users\Admin\AppData\Local\Temp\6184.tmp"80⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\61D2.tmp"C:\Users\Admin\AppData\Local\Temp\61D2.tmp"81⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\6220.tmp"C:\Users\Admin\AppData\Local\Temp\6220.tmp"82⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\626E.tmp"C:\Users\Admin\AppData\Local\Temp\626E.tmp"83⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\62CC.tmp"C:\Users\Admin\AppData\Local\Temp\62CC.tmp"84⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\632A.tmp"C:\Users\Admin\AppData\Local\Temp\632A.tmp"85⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"86⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\63E5.tmp"C:\Users\Admin\AppData\Local\Temp\63E5.tmp"87⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\6443.tmp"C:\Users\Admin\AppData\Local\Temp\6443.tmp"88⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\64A1.tmp"C:\Users\Admin\AppData\Local\Temp\64A1.tmp"89⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\64EF.tmp"C:\Users\Admin\AppData\Local\Temp\64EF.tmp"90⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\653D.tmp"C:\Users\Admin\AppData\Local\Temp\653D.tmp"91⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\658B.tmp"C:\Users\Admin\AppData\Local\Temp\658B.tmp"92⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\65E9.tmp"C:\Users\Admin\AppData\Local\Temp\65E9.tmp"93⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\6637.tmp"C:\Users\Admin\AppData\Local\Temp\6637.tmp"94⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\6695.tmp"C:\Users\Admin\AppData\Local\Temp\6695.tmp"95⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\66E3.tmp"C:\Users\Admin\AppData\Local\Temp\66E3.tmp"96⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\6741.tmp"C:\Users\Admin\AppData\Local\Temp\6741.tmp"97⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\677F.tmp"C:\Users\Admin\AppData\Local\Temp\677F.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\67BE.tmp"C:\Users\Admin\AppData\Local\Temp\67BE.tmp"99⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\681B.tmp"C:\Users\Admin\AppData\Local\Temp\681B.tmp"100⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\6869.tmp"C:\Users\Admin\AppData\Local\Temp\6869.tmp"101⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\68B8.tmp"C:\Users\Admin\AppData\Local\Temp\68B8.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\6906.tmp"C:\Users\Admin\AppData\Local\Temp\6906.tmp"103⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\6963.tmp"C:\Users\Admin\AppData\Local\Temp\6963.tmp"104⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\69B2.tmp"C:\Users\Admin\AppData\Local\Temp\69B2.tmp"105⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"106⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\6A6D.tmp"C:\Users\Admin\AppData\Local\Temp\6A6D.tmp"107⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\6ABB.tmp"C:\Users\Admin\AppData\Local\Temp\6ABB.tmp"108⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\6B19.tmp"C:\Users\Admin\AppData\Local\Temp\6B19.tmp"109⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\6B77.tmp"C:\Users\Admin\AppData\Local\Temp\6B77.tmp"110⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\6BC5.tmp"C:\Users\Admin\AppData\Local\Temp\6BC5.tmp"111⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\6C23.tmp"C:\Users\Admin\AppData\Local\Temp\6C23.tmp"112⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\6C71.tmp"C:\Users\Admin\AppData\Local\Temp\6C71.tmp"113⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"114⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"115⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\6D6B.tmp"C:\Users\Admin\AppData\Local\Temp\6D6B.tmp"116⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\6DB9.tmp"C:\Users\Admin\AppData\Local\Temp\6DB9.tmp"117⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"118⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\6E36.tmp"C:\Users\Admin\AppData\Local\Temp\6E36.tmp"119⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\6E94.tmp"C:\Users\Admin\AppData\Local\Temp\6E94.tmp"120⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"121⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\6F30.tmp"C:\Users\Admin\AppData\Local\Temp\6F30.tmp"122⤵PID:3808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-