Analysis
- max time kernel
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/06/2026, 04:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-01_83060e97288309d38cd2fc30e6ee5601_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-01_83060e97288309d38cd2fc30e6ee5601_elex_mafia_stealc_tofsee.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-06-01_83060e97288309d38cd2fc30e6ee5601_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260601-ev3jsaev4l
- SHA256 3dd6c4e12c22d1a3457fb1a9122d74b6455181c0655a33e1de7a87d7acf4bd5a
- MD5 83060e97288309d38cd2fc30e6ee5601
- SHA1 0e2fee31d58fc4cadf82a7df496e438dbf37452c
- SHA512 7ebac4877f678a5db92cc850337d9a2ded0546a269036acd861278634924fd17e2b80832f664978aed6bd7d606c46ed583dc084724eb8d9a236952c2d778bc36
- SSDEEP 12288:HU5rCOTeiJUnEgnFmcKIkaojg245cbC8kw4oNZ:HUQOJJUnLnwIkao8245cBv4oN
- TLSH T113B4F0217584C433E69202354EE2EBB1693ABC355B22A4C777C43B6E6FB52E1D7B4306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1608 4A14.tmp 3352 4A81.tmp 3844 4ADF.tmp 4124 4B7B.tmp 1100 4C08.tmp 3576 4C85.tmp 1376 4D11.tmp 2244 4D6F.tmp 1948 4DFC.tmp 2476 4EB7.tmp 4768 4F54.tmp 2896 4FF0.tmp 3432 507C.tmp 4632 50F9.tmp 3876 5196.tmp 3548 5242.tmp 1072 52AF.tmp 1532 531C.tmp 704 538A.tmp 2504 5436.tmp 2744 54A3.tmp 2572 5530.tmp 1432 559D.tmp 4328 5639.tmp 2156 56B6.tmp 4068 5752.tmp 576 57CF.tmp 4404 583D.tmp 3592 58E9.tmp 3340 5975.tmp 364 59E3.tmp 2696 5A6F.tmp 332 5ADD.tmp 128 5B5A.tmp 2016 5BB7.tmp 1180 5C06.tmp 3292 5C63.tmp 3644 5CB1.tmp 1060 5D0F.tmp 4628 5D6D.tmp 4588 5DDA.tmp 2192 5E48.tmp 1188 5EB5.tmp 792 5F13.tmp 4504 5F61.tmp 4960 5F9F.tmp 3396 5FDE.tmp 3248 603C.tmp 2160 608A.tmp 2576 60C8.tmp 2736 6116.tmp 4828 6165.tmp 8 61C2.tmp 2996 6220.tmp 1032 627E.tmp 3972 62DC.tmp 1184 6339.tmp 3996 6397.tmp 2856 63E5.tmp 4704 6443.tmp 1132 64A1.tmp 1728 64EF.tmp 2700 653D.tmp 4200 658B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B64B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 423F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 916D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4731.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 267A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 616F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F98E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2476.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E51B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9882.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 983F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4904 wrote to memory of 1608 4904 2026-06-01_83060e97288309d38cd2fc30e6ee5601_elex_mafia_stealc_tofsee.exe 79 PID 1608 wrote to memory of 3352 1608 4A14.tmp 80 PID 3352 wrote to memory of 3844 3352 4A81.tmp 81 PID 3844 wrote to memory of 4124 3844 4ADF.tmp 82 PID 4124 wrote to memory of 1100 4124 4B7B.tmp 83 PID 1100 wrote to memory of 3576 1100 4C08.tmp 84 PID 3576 wrote to memory of 1376 3576 4C85.tmp 85 PID 1376 wrote to memory of 2244 1376 4D11.tmp 86 PID 2244 wrote to memory of 1948 2244 4D6F.tmp 87 PID 1948 wrote to memory of 2476 1948 4DFC.tmp 88 PID 2476 wrote to memory of 4768 2476 4EB7.tmp 89 PID 4768 wrote to memory of 2896 4768 4F54.tmp 90 PID 2896 wrote to memory of 3432 2896 4FF0.tmp 91 PID 3432 wrote to memory of 4632 3432 507C.tmp 92 PID 4632 wrote to memory of 3876 4632 50F9.tmp 93 PID 3876 wrote to memory of 3548 3876 5196.tmp 94 PID 3548 wrote to memory of 1072 3548 5242.tmp 95 PID 1072 wrote to memory of 1532 1072 52AF.tmp 96 PID 1532 wrote to memory of 704 1532 531C.tmp 97 PID 704 wrote to memory of 2504 704 538A.tmp 98 PID 2504 wrote to memory of 2744 2504 5436.tmp 99 PID 2744 wrote to memory of 2572 2744 54A3.tmp 100 PID 2572 wrote to memory of 1432 2572 5530.tmp 101 PID 1432 wrote to memory of 4328 1432 559D.tmp 102 PID 4328 wrote to memory of 2156 4328 5639.tmp 103 PID 2156 wrote to memory of 4068 2156 56B6.tmp 104 PID 4068 wrote to memory of 576 4068 5752.tmp 105 PID 576 wrote to memory of 4404 576 57CF.tmp 106 PID 4404 wrote to memory of 3592 4404 583D.tmp 107 PID 3592 wrote to memory of 3340 3592 58E9.tmp 108 PID 3340 wrote to memory of 364 3340 5975.tmp 109 PID 364 wrote to memory of 2696 364 59E3.tmp 110 PID 2696 wrote to memory of 332 2696 5A6F.tmp 111 PID 332 wrote to memory of 128 332 5ADD.tmp 112 PID 128 wrote to memory of 2016 128 5B5A.tmp 113 PID 2016 wrote to memory of 1180 2016 5BB7.tmp 114 PID 1180 wrote to memory of 3292 1180 5C06.tmp 115 PID 3292 wrote to memory of 3644 3292 5C63.tmp 116 PID 3644 wrote to memory of 1060 3644 5CB1.tmp 117 PID 1060 wrote to memory of 4628 1060 5D0F.tmp 118 PID 4628 wrote to memory of 4588 4628 5D6D.tmp 119 PID 4588 wrote to memory of 2192 4588 5DDA.tmp 120 PID 2192 wrote to memory of 1188 2192 5E48.tmp 121 PID 1188 wrote to memory of 792 1188 5EB5.tmp 122 PID 792 wrote to memory of 4504 792 5F13.tmp 123 PID 4504 wrote to memory of 4960 4504 5F61.tmp 124 PID 4960 wrote to memory of 3396 4960 5F9F.tmp 125 PID 3396 wrote to memory of 3248 3396 5FDE.tmp 126 PID 3248 wrote to memory of 2160 3248 603C.tmp 127 PID 2160 wrote to memory of 2576 2160 608A.tmp 128 PID 2576 wrote to memory of 2736 2576 60C8.tmp 129 PID 2736 wrote to memory of 4828 2736 6116.tmp 130 PID 4828 wrote to memory of 8 4828 6165.tmp 131 PID 8 wrote to memory of 2996 8 61C2.tmp 132 PID 2996 wrote to memory of 1032 2996 6220.tmp 133 PID 1032 wrote to memory of 3972 1032 627E.tmp 134 PID 3972 wrote to memory of 1184 3972 62DC.tmp 135 PID 1184 wrote to memory of 3996 1184 6339.tmp 136 PID 3996 wrote to memory of 2856 3996 6397.tmp 137 PID 2856 wrote to memory of 4704 2856 63E5.tmp 138 PID 4704 wrote to memory of 1132 4704 6443.tmp 139 PID 1132 wrote to memory of 1728 1132 64A1.tmp 140 PID 1728 wrote to memory of 2700 1728 64EF.tmp 141 PID 2700 wrote to memory of 4200 2700 653D.tmp 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-01_83060e97288309d38cd2fc30e6ee5601_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-01_83060e97288309d38cd2fc30e6ee5601_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\4A14.tmp"C:\Users\Admin\AppData\Local\Temp\4A14.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\4A81.tmp"C:\Users\Admin\AppData\Local\Temp\4A81.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\4ADF.tmp"C:\Users\Admin\AppData\Local\Temp\4ADF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\4C08.tmp"C:\Users\Admin\AppData\Local\Temp\4C08.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\4C85.tmp"C:\Users\Admin\AppData\Local\Temp\4C85.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\4D11.tmp"C:\Users\Admin\AppData\Local\Temp\4D11.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\4EB7.tmp"C:\Users\Admin\AppData\Local\Temp\4EB7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\4F54.tmp"C:\Users\Admin\AppData\Local\Temp\4F54.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\507C.tmp"C:\Users\Admin\AppData\Local\Temp\507C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\50F9.tmp"C:\Users\Admin\AppData\Local\Temp\50F9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\5196.tmp"C:\Users\Admin\AppData\Local\Temp\5196.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\5242.tmp"C:\Users\Admin\AppData\Local\Temp\5242.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\52AF.tmp"C:\Users\Admin\AppData\Local\Temp\52AF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\531C.tmp"C:\Users\Admin\AppData\Local\Temp\531C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\5436.tmp"C:\Users\Admin\AppData\Local\Temp\5436.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\54A3.tmp"C:\Users\Admin\AppData\Local\Temp\54A3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\5530.tmp"C:\Users\Admin\AppData\Local\Temp\5530.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\559D.tmp"C:\Users\Admin\AppData\Local\Temp\559D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\5639.tmp"C:\Users\Admin\AppData\Local\Temp\5639.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\56B6.tmp"C:\Users\Admin\AppData\Local\Temp\56B6.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\5752.tmp"C:\Users\Admin\AppData\Local\Temp\5752.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\57CF.tmp"C:\Users\Admin\AppData\Local\Temp\57CF.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\583D.tmp"C:\Users\Admin\AppData\Local\Temp\583D.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\58E9.tmp"C:\Users\Admin\AppData\Local\Temp\58E9.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\5975.tmp"C:\Users\Admin\AppData\Local\Temp\5975.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\59E3.tmp"C:\Users\Admin\AppData\Local\Temp\59E3.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:128 -
C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\5C06.tmp"C:\Users\Admin\AppData\Local\Temp\5C06.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\5C63.tmp"C:\Users\Admin\AppData\Local\Temp\5C63.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"C:\Users\Admin\AppData\Local\Temp\5CB1.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\5D0F.tmp"C:\Users\Admin\AppData\Local\Temp\5D0F.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\5E48.tmp"C:\Users\Admin\AppData\Local\Temp\5E48.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"C:\Users\Admin\AppData\Local\Temp\5EB5.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\5F13.tmp"C:\Users\Admin\AppData\Local\Temp\5F13.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\5F61.tmp"C:\Users\Admin\AppData\Local\Temp\5F61.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\5F9F.tmp"C:\Users\Admin\AppData\Local\Temp\5F9F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\603C.tmp"C:\Users\Admin\AppData\Local\Temp\603C.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\608A.tmp"C:\Users\Admin\AppData\Local\Temp\608A.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\60C8.tmp"C:\Users\Admin\AppData\Local\Temp\60C8.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\6116.tmp"C:\Users\Admin\AppData\Local\Temp\6116.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\6165.tmp"C:\Users\Admin\AppData\Local\Temp\6165.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\61C2.tmp"C:\Users\Admin\AppData\Local\Temp\61C2.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\6220.tmp"C:\Users\Admin\AppData\Local\Temp\6220.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\627E.tmp"C:\Users\Admin\AppData\Local\Temp\627E.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\62DC.tmp"C:\Users\Admin\AppData\Local\Temp\62DC.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\6339.tmp"C:\Users\Admin\AppData\Local\Temp\6339.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\6397.tmp"C:\Users\Admin\AppData\Local\Temp\6397.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\63E5.tmp"C:\Users\Admin\AppData\Local\Temp\63E5.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\6443.tmp"C:\Users\Admin\AppData\Local\Temp\6443.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\64A1.tmp"C:\Users\Admin\AppData\Local\Temp\64A1.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\64EF.tmp"C:\Users\Admin\AppData\Local\Temp\64EF.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\653D.tmp"C:\Users\Admin\AppData\Local\Temp\653D.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\658B.tmp"C:\Users\Admin\AppData\Local\Temp\658B.tmp"65⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\65E9.tmp"C:\Users\Admin\AppData\Local\Temp\65E9.tmp"66⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\6656.tmp"C:\Users\Admin\AppData\Local\Temp\6656.tmp"67⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\66C4.tmp"C:\Users\Admin\AppData\Local\Temp\66C4.tmp"68⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\6731.tmp"C:\Users\Admin\AppData\Local\Temp\6731.tmp"69⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\679E.tmp"C:\Users\Admin\AppData\Local\Temp\679E.tmp"70⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\680C.tmp"C:\Users\Admin\AppData\Local\Temp\680C.tmp"71⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\6879.tmp"C:\Users\Admin\AppData\Local\Temp\6879.tmp"72⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\68D7.tmp"C:\Users\Admin\AppData\Local\Temp\68D7.tmp"73⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\6925.tmp"C:\Users\Admin\AppData\Local\Temp\6925.tmp"74⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\6973.tmp"C:\Users\Admin\AppData\Local\Temp\6973.tmp"75⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\69C1.tmp"C:\Users\Admin\AppData\Local\Temp\69C1.tmp"76⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"77⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"78⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"79⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\6B09.tmp"C:\Users\Admin\AppData\Local\Temp\6B09.tmp"80⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\6B57.tmp"C:\Users\Admin\AppData\Local\Temp\6B57.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"82⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\6C13.tmp"C:\Users\Admin\AppData\Local\Temp\6C13.tmp"83⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\6C61.tmp"C:\Users\Admin\AppData\Local\Temp\6C61.tmp"84⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"85⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"86⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"87⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\6DB9.tmp"C:\Users\Admin\AppData\Local\Temp\6DB9.tmp"88⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\6E07.tmp"C:\Users\Admin\AppData\Local\Temp\6E07.tmp"89⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\6E55.tmp"C:\Users\Admin\AppData\Local\Temp\6E55.tmp"90⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"91⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\6F30.tmp"C:\Users\Admin\AppData\Local\Temp\6F30.tmp"92⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\6F9D.tmp"C:\Users\Admin\AppData\Local\Temp\6F9D.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:768 -
C:\Users\Admin\AppData\Local\Temp\6FEB.tmp"C:\Users\Admin\AppData\Local\Temp\6FEB.tmp"94⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\7039.tmp"C:\Users\Admin\AppData\Local\Temp\7039.tmp"95⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\7088.tmp"C:\Users\Admin\AppData\Local\Temp\7088.tmp"96⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\70F5.tmp"C:\Users\Admin\AppData\Local\Temp\70F5.tmp"97⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\7162.tmp"C:\Users\Admin\AppData\Local\Temp\7162.tmp"98⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\71D0.tmp"C:\Users\Admin\AppData\Local\Temp\71D0.tmp"99⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\721E.tmp"C:\Users\Admin\AppData\Local\Temp\721E.tmp"100⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\726C.tmp"C:\Users\Admin\AppData\Local\Temp\726C.tmp"101⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\72BA.tmp"C:\Users\Admin\AppData\Local\Temp\72BA.tmp"102⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\7308.tmp"C:\Users\Admin\AppData\Local\Temp\7308.tmp"103⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\7356.tmp"C:\Users\Admin\AppData\Local\Temp\7356.tmp"104⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\73A4.tmp"C:\Users\Admin\AppData\Local\Temp\73A4.tmp"105⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\73F3.tmp"C:\Users\Admin\AppData\Local\Temp\73F3.tmp"106⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\7441.tmp"C:\Users\Admin\AppData\Local\Temp\7441.tmp"107⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\749E.tmp"C:\Users\Admin\AppData\Local\Temp\749E.tmp"108⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\74ED.tmp"C:\Users\Admin\AppData\Local\Temp\74ED.tmp"109⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\753B.tmp"C:\Users\Admin\AppData\Local\Temp\753B.tmp"110⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\7589.tmp"C:\Users\Admin\AppData\Local\Temp\7589.tmp"111⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\75D7.tmp"C:\Users\Admin\AppData\Local\Temp\75D7.tmp"112⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\7635.tmp"C:\Users\Admin\AppData\Local\Temp\7635.tmp"113⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\7683.tmp"C:\Users\Admin\AppData\Local\Temp\7683.tmp"114⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\76D1.tmp"C:\Users\Admin\AppData\Local\Temp\76D1.tmp"115⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\772F.tmp"C:\Users\Admin\AppData\Local\Temp\772F.tmp"116⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\777D.tmp"C:\Users\Admin\AppData\Local\Temp\777D.tmp"117⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\77DB.tmp"C:\Users\Admin\AppData\Local\Temp\77DB.tmp"118⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\7838.tmp"C:\Users\Admin\AppData\Local\Temp\7838.tmp"119⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\7896.tmp"C:\Users\Admin\AppData\Local\Temp\7896.tmp"120⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\78F4.tmp"C:\Users\Admin\AppData\Local\Temp\78F4.tmp"121⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\7952.tmp"C:\Users\Admin\AppData\Local\Temp\7952.tmp"122⤵PID:4476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-