Analysis
- max time kernel
130s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 08:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_36fd672d3a648b385e2cefe102007e26_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_36fd672d3a648b385e2cefe102007e26_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260617-en
3 signatures
150 seconds
General
- Target 2026-06-27_36fd672d3a648b385e2cefe102007e26_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260629-kd64jag16x
- SHA256 12542eb41d7c790b41b462d9ef4d1cd57b906e0929f3d3e014a6fec45b549d12
- MD5 36fd672d3a648b385e2cefe102007e26
- SHA1 c90b7d87c75af1e9058970146f05b7a39a579d09
- SHA512 dfdf44cdb597230d69e7052eb332c2d0076473589f5e39b58927ad167147b434a11b5f964cd604ec0126077134de5cc816ef92d93b8dd2c934ed2f9377bd9af0
- SSDEEP 12288:9U5rCOTei6A+yxC7BCBQ5x5JcVmQKQtuN5YqZoXWjdq:9UQOJ6ExKBEQcVm59N5YqqGh
- TLSH T15BC4F125B589C032E9A202714AD2EBB1597B7D314B22A4CB7BD0772E6FB52E1D374307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2236 2D40.tmp 2892 2E0B.tmp 2556 2F05.tmp 1548 2FB1.tmp 1612 304D.tmp 4224 3167.tmp 1528 328F.tmp 1348 336A.tmp 5132 3416.tmp 6028 3510.tmp 5328 35FA.tmp 3472 3687.tmp 5704 3733.tmp 5884 37DF.tmp 4912 389A.tmp 1188 3927.tmp 5692 39C3.tmp 1480 3A5F.tmp 5864 3B3A.tmp 5932 3C05.tmp 4892 3CFF.tmp 1952 3DBB.tmp 2588 3EA5.tmp 5796 3F61.tmp 2996 3FFD.tmp 2564 4099.tmp 5068 4135.tmp 404 41B2.tmp 2408 429D.tmp 2528 4349.tmp 5876 4404.tmp 4356 44DF.tmp 4420 459A.tmp 1064 4627.tmp 1152 46B4.tmp 3488 4721.tmp 2168 479E.tmp 1136 482B.tmp 4496 48C7.tmp 4576 4934.tmp 420 49B1.tmp 3160 4A6D.tmp 5048 4B19.tmp 4200 4BA5.tmp 5032 4C42.tmp 5380 4CCE.tmp 5868 4D5B.tmp 5660 4DD8.tmp 3056 4E55.tmp 5952 4EF1.tmp 3664 4F7E.tmp 3696 500A.tmp 2092 50B6.tmp 4804 5152.tmp 5072 51DF.tmp 1720 524C.tmp 3036 52F8.tmp 2988 53B4.tmp 1372 5440.tmp 1560 54EC.tmp 2868 5598.tmp 2136 5634.tmp 3432 56B1.tmp 4176 572E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2433.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4670.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6708.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B80B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1672.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 996.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 807C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3927.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ABB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 783.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E929.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 572E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A87B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-27_36fd672d3a648b385e2cefe102007e26_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A994.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7824.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 964B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 667C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1588.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4099.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BBB.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 948 wrote to memory of 2236 948 2026-06-27_36fd672d3a648b385e2cefe102007e26_elex_mafia_stealc_tofsee.exe 89 PID 2236 wrote to memory of 2892 2236 2D40.tmp 90 PID 2892 wrote to memory of 2556 2892 2E0B.tmp 91 PID 2556 wrote to memory of 1548 2556 2F05.tmp 92 PID 1548 wrote to memory of 1612 1548 2FB1.tmp 93 PID 1612 wrote to memory of 4224 1612 304D.tmp 94 PID 4224 wrote to memory of 1528 4224 3167.tmp 95 PID 1528 wrote to memory of 1348 1528 328F.tmp 96 PID 1348 wrote to memory of 5132 1348 336A.tmp 97 PID 5132 wrote to memory of 6028 5132 3416.tmp 98 PID 6028 wrote to memory of 5328 6028 3510.tmp 99 PID 5328 wrote to memory of 3472 5328 35FA.tmp 100 PID 3472 wrote to memory of 5704 3472 3687.tmp 101 PID 5704 wrote to memory of 5884 5704 3733.tmp 102 PID 5884 wrote to memory of 4912 5884 37DF.tmp 103 PID 4912 wrote to memory of 1188 4912 389A.tmp 104 PID 1188 wrote to memory of 5692 1188 3927.tmp 105 PID 5692 wrote to memory of 1480 5692 39C3.tmp 106 PID 1480 wrote to memory of 5864 1480 3A5F.tmp 107 PID 5864 wrote to memory of 5932 5864 3B3A.tmp 108 PID 5932 wrote to memory of 4892 5932 3C05.tmp 109 PID 4892 wrote to memory of 1952 4892 3CFF.tmp 110 PID 1952 wrote to memory of 2588 1952 3DBB.tmp 111 PID 2588 wrote to memory of 5796 2588 3EA5.tmp 112 PID 5796 wrote to memory of 2996 5796 3F61.tmp 113 PID 2996 wrote to memory of 2564 2996 3FFD.tmp 114 PID 2564 wrote to memory of 5068 2564 4099.tmp 115 PID 5068 wrote to memory of 404 5068 4135.tmp 116 PID 404 wrote to memory of 2408 404 41B2.tmp 117 PID 2408 wrote to memory of 2528 2408 429D.tmp 118 PID 2528 wrote to memory of 5876 2528 4349.tmp 119 PID 5876 wrote to memory of 4356 5876 4404.tmp 120 PID 4356 wrote to memory of 4420 4356 44DF.tmp 121 PID 4420 wrote to memory of 1064 4420 459A.tmp 122 PID 1064 wrote to memory of 1152 1064 4627.tmp 123 PID 1152 wrote to memory of 3488 1152 46B4.tmp 124 PID 3488 wrote to memory of 2168 3488 4721.tmp 125 PID 2168 wrote to memory of 1136 2168 479E.tmp 126 PID 1136 wrote to memory of 4496 1136 482B.tmp 127 PID 4496 wrote to memory of 4576 4496 48C7.tmp 128 PID 4576 wrote to memory of 420 4576 4934.tmp 129 PID 420 wrote to memory of 3160 420 49B1.tmp 130 PID 3160 wrote to memory of 5048 3160 4A6D.tmp 131 PID 5048 wrote to memory of 4200 5048 4B19.tmp 132 PID 4200 wrote to memory of 5032 4200 4BA5.tmp 133 PID 5032 wrote to memory of 5380 5032 4C42.tmp 134 PID 5380 wrote to memory of 5868 5380 4CCE.tmp 135 PID 5868 wrote to memory of 5660 5868 4D5B.tmp 136 PID 5660 wrote to memory of 3056 5660 4DD8.tmp 137 PID 3056 wrote to memory of 5952 3056 4E55.tmp 138 PID 5952 wrote to memory of 3664 5952 4EF1.tmp 139 PID 3664 wrote to memory of 3696 3664 4F7E.tmp 140 PID 3696 wrote to memory of 2092 3696 500A.tmp 141 PID 2092 wrote to memory of 4804 2092 50B6.tmp 142 PID 4804 wrote to memory of 5072 4804 5152.tmp 143 PID 5072 wrote to memory of 1720 5072 51DF.tmp 144 PID 1720 wrote to memory of 3036 1720 524C.tmp 145 PID 3036 wrote to memory of 2988 3036 52F8.tmp 146 PID 2988 wrote to memory of 1372 2988 53B4.tmp 147 PID 1372 wrote to memory of 1560 1372 5440.tmp 148 PID 1560 wrote to memory of 2868 1560 54EC.tmp 149 PID 2868 wrote to memory of 2136 2868 5598.tmp 150 PID 2136 wrote to memory of 3432 2136 5634.tmp 151 PID 3432 wrote to memory of 4176 3432 56B1.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_36fd672d3a648b385e2cefe102007e26_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_36fd672d3a648b385e2cefe102007e26_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\2D40.tmp"C:\Users\Admin\AppData\Local\Temp\2D40.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\2E0B.tmp"C:\Users\Admin\AppData\Local\Temp\2E0B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\2F05.tmp"C:\Users\Admin\AppData\Local\Temp\2F05.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\304D.tmp"C:\Users\Admin\AppData\Local\Temp\304D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\3167.tmp"C:\Users\Admin\AppData\Local\Temp\3167.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\328F.tmp"C:\Users\Admin\AppData\Local\Temp\328F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\336A.tmp"C:\Users\Admin\AppData\Local\Temp\336A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\3416.tmp"C:\Users\Admin\AppData\Local\Temp\3416.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Users\Admin\AppData\Local\Temp\3510.tmp"C:\Users\Admin\AppData\Local\Temp\3510.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\35FA.tmp"C:\Users\Admin\AppData\Local\Temp\35FA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\3687.tmp"C:\Users\Admin\AppData\Local\Temp\3687.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\3733.tmp"C:\Users\Admin\AppData\Local\Temp\3733.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\37DF.tmp"C:\Users\Admin\AppData\Local\Temp\37DF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\389A.tmp"C:\Users\Admin\AppData\Local\Temp\389A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\3927.tmp"C:\Users\Admin\AppData\Local\Temp\3927.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\39C3.tmp"C:\Users\Admin\AppData\Local\Temp\39C3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\3B3A.tmp"C:\Users\Admin\AppData\Local\Temp\3B3A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\3C05.tmp"C:\Users\Admin\AppData\Local\Temp\3C05.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\3CFF.tmp"C:\Users\Admin\AppData\Local\Temp\3CFF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\3EA5.tmp"C:\Users\Admin\AppData\Local\Temp\3EA5.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\4099.tmp"C:\Users\Admin\AppData\Local\Temp\4099.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\41B2.tmp"C:\Users\Admin\AppData\Local\Temp\41B2.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\429D.tmp"C:\Users\Admin\AppData\Local\Temp\429D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\4349.tmp"C:\Users\Admin\AppData\Local\Temp\4349.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\4404.tmp"C:\Users\Admin\AppData\Local\Temp\4404.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\44DF.tmp"C:\Users\Admin\AppData\Local\Temp\44DF.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\459A.tmp"C:\Users\Admin\AppData\Local\Temp\459A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\4627.tmp"C:\Users\Admin\AppData\Local\Temp\4627.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\46B4.tmp"C:\Users\Admin\AppData\Local\Temp\46B4.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\4721.tmp"C:\Users\Admin\AppData\Local\Temp\4721.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\479E.tmp"C:\Users\Admin\AppData\Local\Temp\479E.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\482B.tmp"C:\Users\Admin\AppData\Local\Temp\482B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\48C7.tmp"C:\Users\Admin\AppData\Local\Temp\48C7.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\4934.tmp"C:\Users\Admin\AppData\Local\Temp\4934.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\49B1.tmp"C:\Users\Admin\AppData\Local\Temp\49B1.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\4B19.tmp"C:\Users\Admin\AppData\Local\Temp\4B19.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\4BA5.tmp"C:\Users\Admin\AppData\Local\Temp\4BA5.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\4C42.tmp"C:\Users\Admin\AppData\Local\Temp\4C42.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\4CCE.tmp"C:\Users\Admin\AppData\Local\Temp\4CCE.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\4D5B.tmp"C:\Users\Admin\AppData\Local\Temp\4D5B.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\4DD8.tmp"C:\Users\Admin\AppData\Local\Temp\4DD8.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\4E55.tmp"C:\Users\Admin\AppData\Local\Temp\4E55.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\500A.tmp"C:\Users\Admin\AppData\Local\Temp\500A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\50B6.tmp"C:\Users\Admin\AppData\Local\Temp\50B6.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\5152.tmp"C:\Users\Admin\AppData\Local\Temp\5152.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\51DF.tmp"C:\Users\Admin\AppData\Local\Temp\51DF.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\524C.tmp"C:\Users\Admin\AppData\Local\Temp\524C.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\52F8.tmp"C:\Users\Admin\AppData\Local\Temp\52F8.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\53B4.tmp"C:\Users\Admin\AppData\Local\Temp\53B4.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\5440.tmp"C:\Users\Admin\AppData\Local\Temp\5440.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\54EC.tmp"C:\Users\Admin\AppData\Local\Temp\54EC.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\5598.tmp"C:\Users\Admin\AppData\Local\Temp\5598.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\5634.tmp"C:\Users\Admin\AppData\Local\Temp\5634.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\56B1.tmp"C:\Users\Admin\AppData\Local\Temp\56B1.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\572E.tmp"C:\Users\Admin\AppData\Local\Temp\572E.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\57BB.tmp"C:\Users\Admin\AppData\Local\Temp\57BB.tmp"66⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\5848.tmp"C:\Users\Admin\AppData\Local\Temp\5848.tmp"67⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\58B5.tmp"C:\Users\Admin\AppData\Local\Temp\58B5.tmp"68⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\5942.tmp"C:\Users\Admin\AppData\Local\Temp\5942.tmp"69⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\59DE.tmp"C:\Users\Admin\AppData\Local\Temp\59DE.tmp"70⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"71⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\5AE8.tmp"C:\Users\Admin\AppData\Local\Temp\5AE8.tmp"72⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\5B93.tmp"C:\Users\Admin\AppData\Local\Temp\5B93.tmp"73⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\5C3F.tmp"C:\Users\Admin\AppData\Local\Temp\5C3F.tmp"74⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\5CDC.tmp"C:\Users\Admin\AppData\Local\Temp\5CDC.tmp"75⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\5D97.tmp"C:\Users\Admin\AppData\Local\Temp\5D97.tmp"76⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\5E33.tmp"C:\Users\Admin\AppData\Local\Temp\5E33.tmp"77⤵PID:5376
-
C:\Users\Admin\AppData\Local\Temp\5EB0.tmp"C:\Users\Admin\AppData\Local\Temp\5EB0.tmp"78⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"79⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\5FE9.tmp"C:\Users\Admin\AppData\Local\Temp\5FE9.tmp"80⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\6056.tmp"C:\Users\Admin\AppData\Local\Temp\6056.tmp"81⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\60E3.tmp"C:\Users\Admin\AppData\Local\Temp\60E3.tmp"82⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\6150.tmp"C:\Users\Admin\AppData\Local\Temp\6150.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\61EC.tmp"C:\Users\Admin\AppData\Local\Temp\61EC.tmp"84⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\6279.tmp"C:\Users\Admin\AppData\Local\Temp\6279.tmp"85⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\6306.tmp"C:\Users\Admin\AppData\Local\Temp\6306.tmp"86⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\6373.tmp"C:\Users\Admin\AppData\Local\Temp\6373.tmp"87⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\640F.tmp"C:\Users\Admin\AppData\Local\Temp\640F.tmp"88⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\648C.tmp"C:\Users\Admin\AppData\Local\Temp\648C.tmp"89⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\64FA.tmp"C:\Users\Admin\AppData\Local\Temp\64FA.tmp"90⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\65A6.tmp"C:\Users\Admin\AppData\Local\Temp\65A6.tmp"91⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\6632.tmp"C:\Users\Admin\AppData\Local\Temp\6632.tmp"92⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\66BF.tmp"C:\Users\Admin\AppData\Local\Temp\66BF.tmp"93⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\672C.tmp"C:\Users\Admin\AppData\Local\Temp\672C.tmp"94⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\67B9.tmp"C:\Users\Admin\AppData\Local\Temp\67B9.tmp"95⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\6836.tmp"C:\Users\Admin\AppData\Local\Temp\6836.tmp"96⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\68B3.tmp"C:\Users\Admin\AppData\Local\Temp\68B3.tmp"97⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\693F.tmp"C:\Users\Admin\AppData\Local\Temp\693F.tmp"98⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\69CC.tmp"C:\Users\Admin\AppData\Local\Temp\69CC.tmp"99⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\6A59.tmp"C:\Users\Admin\AppData\Local\Temp\6A59.tmp"100⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\6B05.tmp"C:\Users\Admin\AppData\Local\Temp\6B05.tmp"101⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\6B91.tmp"C:\Users\Admin\AppData\Local\Temp\6B91.tmp"102⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"103⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\6C9B.tmp"C:\Users\Admin\AppData\Local\Temp\6C9B.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:528 -
C:\Users\Admin\AppData\Local\Temp\6D37.tmp"C:\Users\Admin\AppData\Local\Temp\6D37.tmp"105⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"106⤵PID:124
-
C:\Users\Admin\AppData\Local\Temp\6E7F.tmp"C:\Users\Admin\AppData\Local\Temp\6E7F.tmp"107⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\6F0C.tmp"C:\Users\Admin\AppData\Local\Temp\6F0C.tmp"108⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\6F98.tmp"C:\Users\Admin\AppData\Local\Temp\6F98.tmp"109⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\7025.tmp"C:\Users\Admin\AppData\Local\Temp\7025.tmp"110⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\7092.tmp"C:\Users\Admin\AppData\Local\Temp\7092.tmp"111⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\7100.tmp"C:\Users\Admin\AppData\Local\Temp\7100.tmp"112⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\71AC.tmp"C:\Users\Admin\AppData\Local\Temp\71AC.tmp"113⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\7219.tmp"C:\Users\Admin\AppData\Local\Temp\7219.tmp"114⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\7296.tmp"C:\Users\Admin\AppData\Local\Temp\7296.tmp"115⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\7313.tmp"C:\Users\Admin\AppData\Local\Temp\7313.tmp"116⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\7390.tmp"C:\Users\Admin\AppData\Local\Temp\7390.tmp"117⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\743C.tmp"C:\Users\Admin\AppData\Local\Temp\743C.tmp"118⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\74C9.tmp"C:\Users\Admin\AppData\Local\Temp\74C9.tmp"119⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\7555.tmp"C:\Users\Admin\AppData\Local\Temp\7555.tmp"120⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\75D2.tmp"C:\Users\Admin\AppData\Local\Temp\75D2.tmp"121⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\767E.tmp"C:\Users\Admin\AppData\Local\Temp\767E.tmp"122⤵PID:2340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-