Analysis
- max time kernel
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-04_01a778da80318ca37fe143c00e6c4832_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_01a778da80318ca37fe143c00e6c4832_elex_mafia_stealc_tofsee.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-06-04_01a778da80318ca37fe143c00e6c4832_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260604-ppwt6afy7r
- SHA256 63a646dd1a787779b8f40585a6340cb7e41c38d034d595c95024a1776b259ad5
- MD5 01a778da80318ca37fe143c00e6c4832
- SHA1 1c175de47007a1ed891bfe3e037a571d6c7c9b77
- SHA512 1e240d3c0c9ed5fe36accff1f8924255812f1eec1823a563ace7e4bff2c45df0c7dd98552ff0e68a98a5f7afdffe35e36a353af853913c933f5a8f9d7c6b6492
- SSDEEP 12288:wU5rCOTeiDeG+Xx8Mr8fEkboMW4wduVvNZ+3/v+I9hUG2VA:wUQOJDe9yfEkbtW4wcvNGEA
- TLSH T160E4D02173D88532E5F7037859B5E6614D7EBD326722D6CF2F9022AE09B1BD08A71723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 752 6B48.tmp 760 6BA6.tmp 832 6C03.tmp 1948 6D4B.tmp 4948 6E45.tmp 2712 6EF1.tmp 1676 6F4F.tmp 2528 7068.tmp 1380 7114.tmp 1592 71C0.tmp 2744 724D.tmp 3436 72F9.tmp 5140 73E3.tmp 1188 747F.tmp 4764 754A.tmp 1128 7625.tmp 1484 76E1.tmp 416 779C.tmp 5164 7838.tmp 3180 78E4.tmp 2396 7980.tmp 3920 7A4C.tmp 680 7B17.tmp 3020 7BC3.tmp 1384 7C6E.tmp 2012 7CFB.tmp 1608 7D97.tmp 4008 7E53.tmp 1668 7EFF.tmp 4860 7FBA.tmp 3464 8076.tmp 1072 8112.tmp 5344 81DD.tmp 5356 826A.tmp 5268 82E7.tmp 5296 8383.tmp 5240 8400.tmp 5276 846D.tmp 5464 84CB.tmp 5396 8558.tmp 5400 85C5.tmp 5572 8623.tmp 5820 8690.tmp 5524 870D.tmp 5492 877B.tmp 4172 87D8.tmp 3740 8865.tmp 4836 88F2.tmp 2800 894F.tmp 2768 899D.tmp 2352 89EC.tmp 5916 8A3A.tmp 220 8A97.tmp 5852 8AF5.tmp 3164 8B43.tmp 724 8BA1.tmp 3120 8BEF.tmp 2236 8C3D.tmp 5652 8C8B.tmp 2788 8CDA.tmp 1632 8D28.tmp 3612 8D76.tmp 3184 8DC4.tmp 4936 8E12.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5327.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 899D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9333.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 554A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D17F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 863.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9745.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 456C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A013.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A851.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BADF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BED2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A999.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADCF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B188.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4954.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAAD.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5180 wrote to memory of 752 5180 2026-06-04_01a778da80318ca37fe143c00e6c4832_elex_mafia_stealc_tofsee.exe 80 PID 752 wrote to memory of 760 752 6B48.tmp 81 PID 760 wrote to memory of 832 760 6BA6.tmp 82 PID 832 wrote to memory of 1948 832 6C03.tmp 83 PID 1948 wrote to memory of 4948 1948 6D4B.tmp 84 PID 4948 wrote to memory of 2712 4948 6E45.tmp 85 PID 2712 wrote to memory of 1676 2712 6EF1.tmp 86 PID 1676 wrote to memory of 2528 1676 6F4F.tmp 87 PID 2528 wrote to memory of 1380 2528 7068.tmp 88 PID 1380 wrote to memory of 1592 1380 7114.tmp 89 PID 1592 wrote to memory of 2744 1592 71C0.tmp 90 PID 2744 wrote to memory of 3436 2744 724D.tmp 91 PID 3436 wrote to memory of 5140 3436 72F9.tmp 92 PID 5140 wrote to memory of 1188 5140 73E3.tmp 93 PID 1188 wrote to memory of 4764 1188 747F.tmp 94 PID 4764 wrote to memory of 1128 4764 754A.tmp 95 PID 1128 wrote to memory of 1484 1128 7625.tmp 96 PID 1484 wrote to memory of 416 1484 76E1.tmp 97 PID 416 wrote to memory of 5164 416 779C.tmp 98 PID 5164 wrote to memory of 3180 5164 7838.tmp 99 PID 3180 wrote to memory of 2396 3180 78E4.tmp 100 PID 2396 wrote to memory of 3920 2396 7980.tmp 101 PID 3920 wrote to memory of 680 3920 7A4C.tmp 102 PID 680 wrote to memory of 3020 680 7B17.tmp 103 PID 3020 wrote to memory of 1384 3020 7BC3.tmp 104 PID 1384 wrote to memory of 2012 1384 7C6E.tmp 105 PID 2012 wrote to memory of 1608 2012 7CFB.tmp 106 PID 1608 wrote to memory of 4008 1608 7D97.tmp 107 PID 4008 wrote to memory of 1668 4008 7E53.tmp 108 PID 1668 wrote to memory of 4860 1668 7EFF.tmp 109 PID 4860 wrote to memory of 3464 4860 7FBA.tmp 110 PID 3464 wrote to memory of 1072 3464 8076.tmp 111 PID 1072 wrote to memory of 5344 1072 8112.tmp 112 PID 5344 wrote to memory of 5356 5344 81DD.tmp 113 PID 5356 wrote to memory of 5268 5356 826A.tmp 114 PID 5268 wrote to memory of 5296 5268 82E7.tmp 115 PID 5296 wrote to memory of 5240 5296 8383.tmp 116 PID 5240 wrote to memory of 5276 5240 8400.tmp 117 PID 5276 wrote to memory of 5464 5276 846D.tmp 118 PID 5464 wrote to memory of 5396 5464 84CB.tmp 119 PID 5396 wrote to memory of 5400 5396 8558.tmp 120 PID 5400 wrote to memory of 5572 5400 85C5.tmp 121 PID 5572 wrote to memory of 5820 5572 8623.tmp 122 PID 5820 wrote to memory of 5524 5820 8690.tmp 123 PID 5524 wrote to memory of 5492 5524 870D.tmp 124 PID 5492 wrote to memory of 4172 5492 877B.tmp 125 PID 4172 wrote to memory of 3740 4172 87D8.tmp 126 PID 3740 wrote to memory of 4836 3740 8865.tmp 127 PID 4836 wrote to memory of 2800 4836 88F2.tmp 128 PID 2800 wrote to memory of 2768 2800 894F.tmp 129 PID 2768 wrote to memory of 2352 2768 899D.tmp 130 PID 2352 wrote to memory of 5916 2352 89EC.tmp 131 PID 5916 wrote to memory of 220 5916 8A3A.tmp 132 PID 220 wrote to memory of 5852 220 8A97.tmp 133 PID 5852 wrote to memory of 3164 5852 8AF5.tmp 134 PID 3164 wrote to memory of 724 3164 8B43.tmp 135 PID 724 wrote to memory of 3120 724 8BA1.tmp 136 PID 3120 wrote to memory of 2236 3120 8BEF.tmp 137 PID 2236 wrote to memory of 5652 2236 8C3D.tmp 138 PID 5652 wrote to memory of 2788 5652 8C8B.tmp 139 PID 2788 wrote to memory of 1632 2788 8CDA.tmp 140 PID 1632 wrote to memory of 3612 1632 8D28.tmp 141 PID 3612 wrote to memory of 3184 3612 8D76.tmp 142 PID 3184 wrote to memory of 4936 3184 8DC4.tmp 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_01a778da80318ca37fe143c00e6c4832_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_01a778da80318ca37fe143c00e6c4832_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\6B48.tmp"C:\Users\Admin\AppData\Local\Temp\6B48.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\6C03.tmp"C:\Users\Admin\AppData\Local\Temp\6C03.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\6E45.tmp"C:\Users\Admin\AppData\Local\Temp\6E45.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\6F4F.tmp"C:\Users\Admin\AppData\Local\Temp\6F4F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\7068.tmp"C:\Users\Admin\AppData\Local\Temp\7068.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\7114.tmp"C:\Users\Admin\AppData\Local\Temp\7114.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\71C0.tmp"C:\Users\Admin\AppData\Local\Temp\71C0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\724D.tmp"C:\Users\Admin\AppData\Local\Temp\724D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\72F9.tmp"C:\Users\Admin\AppData\Local\Temp\72F9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\73E3.tmp"C:\Users\Admin\AppData\Local\Temp\73E3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\747F.tmp"C:\Users\Admin\AppData\Local\Temp\747F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\754A.tmp"C:\Users\Admin\AppData\Local\Temp\754A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\7625.tmp"C:\Users\Admin\AppData\Local\Temp\7625.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\76E1.tmp"C:\Users\Admin\AppData\Local\Temp\76E1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\779C.tmp"C:\Users\Admin\AppData\Local\Temp\779C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\7838.tmp"C:\Users\Admin\AppData\Local\Temp\7838.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\78E4.tmp"C:\Users\Admin\AppData\Local\Temp\78E4.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\7980.tmp"C:\Users\Admin\AppData\Local\Temp\7980.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\7B17.tmp"C:\Users\Admin\AppData\Local\Temp\7B17.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\7CFB.tmp"C:\Users\Admin\AppData\Local\Temp\7CFB.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\7D97.tmp"C:\Users\Admin\AppData\Local\Temp\7D97.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\7E53.tmp"C:\Users\Admin\AppData\Local\Temp\7E53.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\8076.tmp"C:\Users\Admin\AppData\Local\Temp\8076.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\826A.tmp"C:\Users\Admin\AppData\Local\Temp\826A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\82E7.tmp"C:\Users\Admin\AppData\Local\Temp\82E7.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\8383.tmp"C:\Users\Admin\AppData\Local\Temp\8383.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\8400.tmp"C:\Users\Admin\AppData\Local\Temp\8400.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Users\Admin\AppData\Local\Temp\846D.tmp"C:\Users\Admin\AppData\Local\Temp\846D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Users\Admin\AppData\Local\Temp\84CB.tmp"C:\Users\Admin\AppData\Local\Temp\84CB.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\8558.tmp"C:\Users\Admin\AppData\Local\Temp\8558.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\85C5.tmp"C:\Users\Admin\AppData\Local\Temp\85C5.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\8623.tmp"C:\Users\Admin\AppData\Local\Temp\8623.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\8690.tmp"C:\Users\Admin\AppData\Local\Temp\8690.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\870D.tmp"C:\Users\Admin\AppData\Local\Temp\870D.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\877B.tmp"C:\Users\Admin\AppData\Local\Temp\877B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\87D8.tmp"C:\Users\Admin\AppData\Local\Temp\87D8.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\8865.tmp"C:\Users\Admin\AppData\Local\Temp\8865.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\88F2.tmp"C:\Users\Admin\AppData\Local\Temp\88F2.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\894F.tmp"C:\Users\Admin\AppData\Local\Temp\894F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\899D.tmp"C:\Users\Admin\AppData\Local\Temp\899D.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\89EC.tmp"C:\Users\Admin\AppData\Local\Temp\89EC.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\8A3A.tmp"C:\Users\Admin\AppData\Local\Temp\8A3A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\8A97.tmp"C:\Users\Admin\AppData\Local\Temp\8A97.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\8AF5.tmp"C:\Users\Admin\AppData\Local\Temp\8AF5.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\8B43.tmp"C:\Users\Admin\AppData\Local\Temp\8B43.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\8BA1.tmp"C:\Users\Admin\AppData\Local\Temp\8BA1.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\8C8B.tmp"C:\Users\Admin\AppData\Local\Temp\8C8B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\8CDA.tmp"C:\Users\Admin\AppData\Local\Temp\8CDA.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\8D28.tmp"C:\Users\Admin\AppData\Local\Temp\8D28.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\8D76.tmp"C:\Users\Admin\AppData\Local\Temp\8D76.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\8E12.tmp"C:\Users\Admin\AppData\Local\Temp\8E12.tmp"65⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\8E60.tmp"C:\Users\Admin\AppData\Local\Temp\8E60.tmp"66⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"67⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\8EFC.tmp"C:\Users\Admin\AppData\Local\Temp\8EFC.tmp"68⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"69⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"70⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\8FF6.tmp"C:\Users\Admin\AppData\Local\Temp\8FF6.tmp"71⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\9045.tmp"C:\Users\Admin\AppData\Local\Temp\9045.tmp"72⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\90A2.tmp"C:\Users\Admin\AppData\Local\Temp\90A2.tmp"73⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\9100.tmp"C:\Users\Admin\AppData\Local\Temp\9100.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\915E.tmp"C:\Users\Admin\AppData\Local\Temp\915E.tmp"75⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\91AC.tmp"C:\Users\Admin\AppData\Local\Temp\91AC.tmp"76⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\91FA.tmp"C:\Users\Admin\AppData\Local\Temp\91FA.tmp"77⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\9248.tmp"C:\Users\Admin\AppData\Local\Temp\9248.tmp"78⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\9296.tmp"C:\Users\Admin\AppData\Local\Temp\9296.tmp"79⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\92E4.tmp"C:\Users\Admin\AppData\Local\Temp\92E4.tmp"80⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\9333.tmp"C:\Users\Admin\AppData\Local\Temp\9333.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\9381.tmp"C:\Users\Admin\AppData\Local\Temp\9381.tmp"82⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\93DE.tmp"C:\Users\Admin\AppData\Local\Temp\93DE.tmp"83⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\943C.tmp"C:\Users\Admin\AppData\Local\Temp\943C.tmp"84⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\948A.tmp"C:\Users\Admin\AppData\Local\Temp\948A.tmp"85⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\94D8.tmp"C:\Users\Admin\AppData\Local\Temp\94D8.tmp"86⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\9527.tmp"C:\Users\Admin\AppData\Local\Temp\9527.tmp"87⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\9575.tmp"C:\Users\Admin\AppData\Local\Temp\9575.tmp"88⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\95C3.tmp"C:\Users\Admin\AppData\Local\Temp\95C3.tmp"89⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\9611.tmp"C:\Users\Admin\AppData\Local\Temp\9611.tmp"90⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\965F.tmp"C:\Users\Admin\AppData\Local\Temp\965F.tmp"91⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\96AD.tmp"C:\Users\Admin\AppData\Local\Temp\96AD.tmp"92⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\96FB.tmp"C:\Users\Admin\AppData\Local\Temp\96FB.tmp"93⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\9749.tmp"C:\Users\Admin\AppData\Local\Temp\9749.tmp"94⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\97A7.tmp"C:\Users\Admin\AppData\Local\Temp\97A7.tmp"95⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\9805.tmp"C:\Users\Admin\AppData\Local\Temp\9805.tmp"96⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\9853.tmp"C:\Users\Admin\AppData\Local\Temp\9853.tmp"97⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\98A1.tmp"C:\Users\Admin\AppData\Local\Temp\98A1.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\98EF.tmp"C:\Users\Admin\AppData\Local\Temp\98EF.tmp"99⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\993D.tmp"C:\Users\Admin\AppData\Local\Temp\993D.tmp"100⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\999B.tmp"C:\Users\Admin\AppData\Local\Temp\999B.tmp"101⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\99E9.tmp"C:\Users\Admin\AppData\Local\Temp\99E9.tmp"102⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\9A37.tmp"C:\Users\Admin\AppData\Local\Temp\9A37.tmp"103⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\9A95.tmp"C:\Users\Admin\AppData\Local\Temp\9A95.tmp"104⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\9AE3.tmp"C:\Users\Admin\AppData\Local\Temp\9AE3.tmp"105⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\9B31.tmp"C:\Users\Admin\AppData\Local\Temp\9B31.tmp"106⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\9B8F.tmp"C:\Users\Admin\AppData\Local\Temp\9B8F.tmp"107⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\9BDD.tmp"C:\Users\Admin\AppData\Local\Temp\9BDD.tmp"108⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\9C4B.tmp"C:\Users\Admin\AppData\Local\Temp\9C4B.tmp"109⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\9C99.tmp"C:\Users\Admin\AppData\Local\Temp\9C99.tmp"110⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\9CE7.tmp"C:\Users\Admin\AppData\Local\Temp\9CE7.tmp"111⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\9D35.tmp"C:\Users\Admin\AppData\Local\Temp\9D35.tmp"112⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\9D83.tmp"C:\Users\Admin\AppData\Local\Temp\9D83.tmp"113⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\9DD1.tmp"C:\Users\Admin\AppData\Local\Temp\9DD1.tmp"114⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\9E2F.tmp"C:\Users\Admin\AppData\Local\Temp\9E2F.tmp"115⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\9E7D.tmp"C:\Users\Admin\AppData\Local\Temp\9E7D.tmp"116⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\9ECB.tmp"C:\Users\Admin\AppData\Local\Temp\9ECB.tmp"117⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\9F19.tmp"C:\Users\Admin\AppData\Local\Temp\9F19.tmp"118⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\9F68.tmp"C:\Users\Admin\AppData\Local\Temp\9F68.tmp"119⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\9FC5.tmp"C:\Users\Admin\AppData\Local\Temp\9FC5.tmp"120⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\A013.tmp"C:\Users\Admin\AppData\Local\Temp\A013.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\A071.tmp"C:\Users\Admin\AppData\Local\Temp\A071.tmp"122⤵PID:5472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-