Analysis
- max time kernel
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 12:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_84498f716557a6b8b0c26fbfc9a09861_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_84498f716557a6b8b0c26fbfc9a09861_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-07-12_84498f716557a6b8b0c26fbfc9a09861_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260712-ppzaaahy6q
- SHA256 92d6e0aeae478ef8967640461918afe1085b545ca9fc664178926889d562eaae
- MD5 84498f716557a6b8b0c26fbfc9a09861
- SHA1 45a400139b072327867837b75b4ec22b9bb4a38f
- SHA512 937f83dda758064e15e0075b031859b60f08d3857dcac4f37bf1745c68dacea1e15de4145f22a84fea8c61c9bdf9a7e103fe7052e20831752f63c5aab83a5320
- SSDEEP 12288:NU5rCOTeij7l2hgVXIdLzFAMhUtcbRCaXSHiTZwlH4Hp:NUQOJj7EhgVXqL5AMDC5HiTSlH4Hp
- TLSH T1E4B4E0267644C533E68202710EE6EBF22A3BBC35173694C72794627E2FB16E1D379346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2052 F9BD.tmp 3292 FAC6.tmp 4684 FBC0.tmp 3464 FC7C.tmp 4116 FD76.tmp 5060 FE12.tmp 4656 FEAE.tmp 4388 FFB8.tmp 3280 110.tmp 5496 2C5.tmp 2768 3DE.tmp 4492 46B.tmp 3916 546.tmp 1688 5E2.tmp 5776 6AD.tmp 988 788.tmp 2680 853.tmp 3128 90E.tmp 1896 9BA.tmp 5148 A76.tmp 3964 B41.tmp 1160 C3B.tmp 5600 CC8.tmp 2744 D83.tmp 2984 E10.tmp 4252 E9C.tmp 3880 F87.tmp 3124 1023.tmp 5012 10FE.tmp 2720 11C9.tmp 5720 1265.tmp 4672 1311.tmp 1668 13BD.tmp 3884 143A.tmp 4784 14E6.tmp 3844 1563.tmp 5028 160F.tmp 4764 16BA.tmp 5652 1757.tmp 5356 17C4.tmp 4752 1860.tmp 1788 18ED.tmp 1772 196A.tmp 4060 19F7.tmp 2884 1A74.tmp 5492 1B10.tmp 3364 1B8D.tmp 2416 1C29.tmp 1152 1CE5.tmp 2864 1D52.tmp 692 1DEE.tmp 3372 1E8A.tmp 5288 1F17.tmp 1676 1FB3.tmp 2604 2050.tmp 2752 20DC.tmp 1528 2178.tmp 4980 2205.tmp 1764 22A1.tmp 2372 234D.tmp 4588 23E9.tmp 4288 2476.tmp 4660 2503.tmp 5228 258F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9329.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A78C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E35C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 160F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D69F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 375D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 996.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3752.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D71C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 764A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4481.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 662D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F212.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E09D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6315.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8795.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 908E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 541C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 699.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5896.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C98B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8320.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E66E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 136A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B7B.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5024 wrote to memory of 2052 5024 2026-07-12_84498f716557a6b8b0c26fbfc9a09861_elex_mafia_stealc_tofsee.exe 87 PID 2052 wrote to memory of 3292 2052 F9BD.tmp 88 PID 3292 wrote to memory of 4684 3292 FAC6.tmp 89 PID 4684 wrote to memory of 3464 4684 FBC0.tmp 90 PID 3464 wrote to memory of 4116 3464 FC7C.tmp 91 PID 4116 wrote to memory of 5060 4116 FD76.tmp 92 PID 5060 wrote to memory of 4656 5060 FE12.tmp 93 PID 4656 wrote to memory of 4388 4656 FEAE.tmp 94 PID 4388 wrote to memory of 3280 4388 FFB8.tmp 95 PID 3280 wrote to memory of 5496 3280 110.tmp 96 PID 5496 wrote to memory of 2768 5496 2C5.tmp 97 PID 2768 wrote to memory of 4492 2768 3DE.tmp 98 PID 4492 wrote to memory of 3916 4492 46B.tmp 99 PID 3916 wrote to memory of 1688 3916 546.tmp 100 PID 1688 wrote to memory of 5776 1688 5E2.tmp 101 PID 5776 wrote to memory of 988 5776 6AD.tmp 102 PID 988 wrote to memory of 2680 988 788.tmp 103 PID 2680 wrote to memory of 3128 2680 853.tmp 104 PID 3128 wrote to memory of 1896 3128 90E.tmp 105 PID 1896 wrote to memory of 5148 1896 9BA.tmp 106 PID 5148 wrote to memory of 3964 5148 A76.tmp 107 PID 3964 wrote to memory of 1160 3964 B41.tmp 108 PID 1160 wrote to memory of 5600 1160 C3B.tmp 109 PID 5600 wrote to memory of 2744 5600 CC8.tmp 110 PID 2744 wrote to memory of 2984 2744 D83.tmp 111 PID 2984 wrote to memory of 4252 2984 E10.tmp 112 PID 4252 wrote to memory of 3880 4252 E9C.tmp 113 PID 3880 wrote to memory of 3124 3880 F87.tmp 114 PID 3124 wrote to memory of 5012 3124 1023.tmp 115 PID 5012 wrote to memory of 2720 5012 10FE.tmp 116 PID 2720 wrote to memory of 5720 2720 11C9.tmp 117 PID 5720 wrote to memory of 4672 5720 1265.tmp 118 PID 4672 wrote to memory of 1668 4672 1311.tmp 119 PID 1668 wrote to memory of 3884 1668 13BD.tmp 120 PID 3884 wrote to memory of 4784 3884 143A.tmp 121 PID 4784 wrote to memory of 3844 4784 14E6.tmp 122 PID 3844 wrote to memory of 5028 3844 1563.tmp 123 PID 5028 wrote to memory of 4764 5028 160F.tmp 124 PID 4764 wrote to memory of 5652 4764 16BA.tmp 125 PID 5652 wrote to memory of 5356 5652 1757.tmp 126 PID 5356 wrote to memory of 4752 5356 17C4.tmp 127 PID 4752 wrote to memory of 1788 4752 1860.tmp 128 PID 1788 wrote to memory of 1772 1788 18ED.tmp 129 PID 1772 wrote to memory of 4060 1772 196A.tmp 130 PID 4060 wrote to memory of 2884 4060 19F7.tmp 131 PID 2884 wrote to memory of 5492 2884 1A74.tmp 132 PID 5492 wrote to memory of 3364 5492 1B10.tmp 133 PID 3364 wrote to memory of 2416 3364 1B8D.tmp 134 PID 2416 wrote to memory of 1152 2416 1C29.tmp 135 PID 1152 wrote to memory of 2864 1152 1CE5.tmp 136 PID 2864 wrote to memory of 692 2864 1D52.tmp 137 PID 692 wrote to memory of 3372 692 1DEE.tmp 138 PID 3372 wrote to memory of 5288 3372 1E8A.tmp 139 PID 5288 wrote to memory of 1676 5288 1F17.tmp 140 PID 1676 wrote to memory of 2604 1676 1FB3.tmp 141 PID 2604 wrote to memory of 2752 2604 2050.tmp 142 PID 2752 wrote to memory of 1528 2752 20DC.tmp 143 PID 1528 wrote to memory of 4980 1528 2178.tmp 144 PID 4980 wrote to memory of 1764 4980 2205.tmp 145 PID 1764 wrote to memory of 2372 1764 22A1.tmp 146 PID 2372 wrote to memory of 4588 2372 234D.tmp 147 PID 4588 wrote to memory of 4288 4588 23E9.tmp 148 PID 4288 wrote to memory of 4660 4288 2476.tmp 149 PID 4660 wrote to memory of 5228 4660 2503.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_84498f716557a6b8b0c26fbfc9a09861_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_84498f716557a6b8b0c26fbfc9a09861_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\F9BD.tmp"C:\Users\Admin\AppData\Local\Temp\F9BD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\FAC6.tmp"C:\Users\Admin\AppData\Local\Temp\FAC6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\FBC0.tmp"C:\Users\Admin\AppData\Local\Temp\FBC0.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\FC7C.tmp"C:\Users\Admin\AppData\Local\Temp\FC7C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\FD76.tmp"C:\Users\Admin\AppData\Local\Temp\FD76.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\FE12.tmp"C:\Users\Admin\AppData\Local\Temp\FE12.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\FEAE.tmp"C:\Users\Admin\AppData\Local\Temp\FEAE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\FFB8.tmp"C:\Users\Admin\AppData\Local\Temp\FFB8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\110.tmp"C:\Users\Admin\AppData\Local\Temp\110.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\2C5.tmp"C:\Users\Admin\AppData\Local\Temp\2C5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\3DE.tmp"C:\Users\Admin\AppData\Local\Temp\3DE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\46B.tmp"C:\Users\Admin\AppData\Local\Temp\46B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\546.tmp"C:\Users\Admin\AppData\Local\Temp\546.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\5E2.tmp"C:\Users\Admin\AppData\Local\Temp\5E2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\6AD.tmp"C:\Users\Admin\AppData\Local\Temp\6AD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\788.tmp"C:\Users\Admin\AppData\Local\Temp\788.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\853.tmp"C:\Users\Admin\AppData\Local\Temp\853.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\90E.tmp"C:\Users\Admin\AppData\Local\Temp\90E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\9BA.tmp"C:\Users\Admin\AppData\Local\Temp\9BA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\A76.tmp"C:\Users\Admin\AppData\Local\Temp\A76.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\B41.tmp"C:\Users\Admin\AppData\Local\Temp\B41.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\C3B.tmp"C:\Users\Admin\AppData\Local\Temp\C3B.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\CC8.tmp"C:\Users\Admin\AppData\Local\Temp\CC8.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\D83.tmp"C:\Users\Admin\AppData\Local\Temp\D83.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\E10.tmp"C:\Users\Admin\AppData\Local\Temp\E10.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\E9C.tmp"C:\Users\Admin\AppData\Local\Temp\E9C.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\F87.tmp"C:\Users\Admin\AppData\Local\Temp\F87.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\1023.tmp"C:\Users\Admin\AppData\Local\Temp\1023.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\10FE.tmp"C:\Users\Admin\AppData\Local\Temp\10FE.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\11C9.tmp"C:\Users\Admin\AppData\Local\Temp\11C9.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\1265.tmp"C:\Users\Admin\AppData\Local\Temp\1265.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Users\Admin\AppData\Local\Temp\1311.tmp"C:\Users\Admin\AppData\Local\Temp\1311.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\13BD.tmp"C:\Users\Admin\AppData\Local\Temp\13BD.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\143A.tmp"C:\Users\Admin\AppData\Local\Temp\143A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\14E6.tmp"C:\Users\Admin\AppData\Local\Temp\14E6.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\1563.tmp"C:\Users\Admin\AppData\Local\Temp\1563.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\160F.tmp"C:\Users\Admin\AppData\Local\Temp\160F.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\16BA.tmp"C:\Users\Admin\AppData\Local\Temp\16BA.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\1757.tmp"C:\Users\Admin\AppData\Local\Temp\1757.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\17C4.tmp"C:\Users\Admin\AppData\Local\Temp\17C4.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\1860.tmp"C:\Users\Admin\AppData\Local\Temp\1860.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\19F7.tmp"C:\Users\Admin\AppData\Local\Temp\19F7.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\1A74.tmp"C:\Users\Admin\AppData\Local\Temp\1A74.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\1B10.tmp"C:\Users\Admin\AppData\Local\Temp\1B10.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\1B8D.tmp"C:\Users\Admin\AppData\Local\Temp\1B8D.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\1C29.tmp"C:\Users\Admin\AppData\Local\Temp\1C29.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\1CE5.tmp"C:\Users\Admin\AppData\Local\Temp\1CE5.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\1D52.tmp"C:\Users\Admin\AppData\Local\Temp\1D52.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\1F17.tmp"C:\Users\Admin\AppData\Local\Temp\1F17.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Users\Admin\AppData\Local\Temp\1FB3.tmp"C:\Users\Admin\AppData\Local\Temp\1FB3.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\2050.tmp"C:\Users\Admin\AppData\Local\Temp\2050.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\20DC.tmp"C:\Users\Admin\AppData\Local\Temp\20DC.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\2178.tmp"C:\Users\Admin\AppData\Local\Temp\2178.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\2205.tmp"C:\Users\Admin\AppData\Local\Temp\2205.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\22A1.tmp"C:\Users\Admin\AppData\Local\Temp\22A1.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\234D.tmp"C:\Users\Admin\AppData\Local\Temp\234D.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\23E9.tmp"C:\Users\Admin\AppData\Local\Temp\23E9.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\2476.tmp"C:\Users\Admin\AppData\Local\Temp\2476.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\2503.tmp"C:\Users\Admin\AppData\Local\Temp\2503.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\258F.tmp"C:\Users\Admin\AppData\Local\Temp\258F.tmp"65⤵
- Executes dropped EXE
PID:5228 -
C:\Users\Admin\AppData\Local\Temp\25FD.tmp"C:\Users\Admin\AppData\Local\Temp\25FD.tmp"66⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\2689.tmp"C:\Users\Admin\AppData\Local\Temp\2689.tmp"67⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\2706.tmp"C:\Users\Admin\AppData\Local\Temp\2706.tmp"68⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\2793.tmp"C:\Users\Admin\AppData\Local\Temp\2793.tmp"69⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\282F.tmp"C:\Users\Admin\AppData\Local\Temp\282F.tmp"70⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\28AC.tmp"C:\Users\Admin\AppData\Local\Temp\28AC.tmp"71⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\2939.tmp"C:\Users\Admin\AppData\Local\Temp\2939.tmp"72⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\29C5.tmp"C:\Users\Admin\AppData\Local\Temp\29C5.tmp"73⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\2A62.tmp"C:\Users\Admin\AppData\Local\Temp\2A62.tmp"74⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\2AEE.tmp"C:\Users\Admin\AppData\Local\Temp\2AEE.tmp"75⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\2B7B.tmp"C:\Users\Admin\AppData\Local\Temp\2B7B.tmp"76⤵PID:5464
-
C:\Users\Admin\AppData\Local\Temp\2BF8.tmp"C:\Users\Admin\AppData\Local\Temp\2BF8.tmp"77⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\2C94.tmp"C:\Users\Admin\AppData\Local\Temp\2C94.tmp"78⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\2D21.tmp"C:\Users\Admin\AppData\Local\Temp\2D21.tmp"79⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"80⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\2E69.tmp"C:\Users\Admin\AppData\Local\Temp\2E69.tmp"81⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\2F34.tmp"C:\Users\Admin\AppData\Local\Temp\2F34.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"83⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\305D.tmp"C:\Users\Admin\AppData\Local\Temp\305D.tmp"84⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\30CA.tmp"C:\Users\Admin\AppData\Local\Temp\30CA.tmp"85⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\3157.tmp"C:\Users\Admin\AppData\Local\Temp\3157.tmp"86⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\31F3.tmp"C:\Users\Admin\AppData\Local\Temp\31F3.tmp"87⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\328F.tmp"C:\Users\Admin\AppData\Local\Temp\328F.tmp"88⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\333B.tmp"C:\Users\Admin\AppData\Local\Temp\333B.tmp"89⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\33D8.tmp"C:\Users\Admin\AppData\Local\Temp\33D8.tmp"90⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\3464.tmp"C:\Users\Admin\AppData\Local\Temp\3464.tmp"91⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\34E1.tmp"C:\Users\Admin\AppData\Local\Temp\34E1.tmp"92⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\356E.tmp"C:\Users\Admin\AppData\Local\Temp\356E.tmp"93⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\360A.tmp"C:\Users\Admin\AppData\Local\Temp\360A.tmp"94⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\3687.tmp"C:\Users\Admin\AppData\Local\Temp\3687.tmp"95⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\3752.tmp"C:\Users\Admin\AppData\Local\Temp\3752.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\37CF.tmp"C:\Users\Admin\AppData\Local\Temp\37CF.tmp"97⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\384C.tmp"C:\Users\Admin\AppData\Local\Temp\384C.tmp"98⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\38E8.tmp"C:\Users\Admin\AppData\Local\Temp\38E8.tmp"99⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\3965.tmp"C:\Users\Admin\AppData\Local\Temp\3965.tmp"100⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\3A02.tmp"C:\Users\Admin\AppData\Local\Temp\3A02.tmp"101⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"102⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"103⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\3BA8.tmp"C:\Users\Admin\AppData\Local\Temp\3BA8.tmp"104⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\3C34.tmp"C:\Users\Admin\AppData\Local\Temp\3C34.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\3CD0.tmp"C:\Users\Admin\AppData\Local\Temp\3CD0.tmp"106⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\3D6D.tmp"C:\Users\Admin\AppData\Local\Temp\3D6D.tmp"107⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"C:\Users\Admin\AppData\Local\Temp\3DF9.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"109⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"110⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"111⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"112⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"113⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\41A3.tmp"C:\Users\Admin\AppData\Local\Temp\41A3.tmp"114⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\424F.tmp"C:\Users\Admin\AppData\Local\Temp\424F.tmp"115⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\42EB.tmp"C:\Users\Admin\AppData\Local\Temp\42EB.tmp"116⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\4378.tmp"C:\Users\Admin\AppData\Local\Temp\4378.tmp"117⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\4404.tmp"C:\Users\Admin\AppData\Local\Temp\4404.tmp"118⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\4481.tmp"C:\Users\Admin\AppData\Local\Temp\4481.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\44FE.tmp"C:\Users\Admin\AppData\Local\Temp\44FE.tmp"120⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\458B.tmp"C:\Users\Admin\AppData\Local\Temp\458B.tmp"121⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\4608.tmp"C:\Users\Admin\AppData\Local\Temp\4608.tmp"122⤵PID:5800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-