Analysis
- max time kernel
120s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 17:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_509483461d519fd4a2d06dbeb467a948_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_509483461d519fd4a2d06dbeb467a948_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-12_509483461d519fd4a2d06dbeb467a948_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260712-vql91ad13p
- SHA256 9ee8c16400dd1075e2372695b1f6f1c4abe214acfa41b4265272c3cef078a47b
- MD5 509483461d519fd4a2d06dbeb467a948
- SHA1 191018fa7e2e1fa9c6b03b1d1504f473929bd4c5
- SHA512 81af42fc427a4f982b63c0c1de0436cc468667d2fed63042e7b404656ce31b549f82d0a296ff9b413bff948511b216838f2aa6d606f2827159365a38562014e6
- SSDEEP 12288:wU5rCOTeiD/TKY09buNQJtxeJod+emQ3oNZ+3/v+I9hUG2VA:wUQOJD/Tf0lbx1d+emQYNGEA
- TLSH T100E4D02173D88536E5FB037859B5E7604DBEBD22A712D6CF2F8051AE09B1BD09A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4660 FDD3.tmp 2480 FEED.tmp 3944 FFE7.tmp 2860 11F.tmp 2080 1AC.tmp 4144 229.tmp 4192 371.tmp 2952 46B.tmp 4900 565.tmp 4640 6CC.tmp 4796 7D6.tmp 1516 91E.tmp 4608 A08.tmp 4396 B12.tmp 708 C0C.tmp 5084 D16.tmp 3124 E10.tmp 4860 F29.tmp 3760 1023.tmp 2988 110D.tmp 252 1227.tmp 1480 134F.tmp 2976 1459.tmp 1456 1572.tmp 3156 167C.tmp 3696 1786.tmp 4820 1860.tmp 4416 195A.tmp 5268 1A45.tmp 1648 1B10.tmp 1132 1C68.tmp 6008 1D71.tmp 2172 1E8A.tmp 4600 1F46.tmp 4452 2021.tmp 1664 20CD.tmp 2552 2178.tmp 4568 2215.tmp 4768 22C1.tmp 4804 234D.tmp 1512 2418.tmp 2248 24C4.tmp 1428 2560.tmp 2168 260C.tmp 5712 26B8.tmp 3044 2774.tmp 2888 2820.tmp 2864 28DB.tmp 2752 2948.tmp 2620 29D5.tmp 4336 2A42.tmp 5156 2ACF.tmp 2444 2B4C.tmp 6072 2BC9.tmp 4264 2C46.tmp 5012 2CC3.tmp 5400 2D40.tmp 4120 2DCD.tmp 1680 2E4A.tmp 1504 2EB7.tmp 1976 2F24.tmp 2432 2FB1.tmp 3592 303E.tmp 3316 30BB.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2608.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D042.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3157.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F67C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C143.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 281B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4586.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E65F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D99D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E19C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A45F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 134F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 985E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C579.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 252D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C66E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A152.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C584.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 910B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38C4.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1772 wrote to memory of 4660 1772 2026-07-12_509483461d519fd4a2d06dbeb467a948_elex_mafia_stealc_tofsee.exe 88 PID 4660 wrote to memory of 2480 4660 FDD3.tmp 89 PID 2480 wrote to memory of 3944 2480 FEED.tmp 90 PID 3944 wrote to memory of 2860 3944 FFE7.tmp 91 PID 2860 wrote to memory of 2080 2860 11F.tmp 92 PID 2080 wrote to memory of 4144 2080 1AC.tmp 93 PID 4144 wrote to memory of 4192 4144 229.tmp 94 PID 4192 wrote to memory of 2952 4192 371.tmp 95 PID 2952 wrote to memory of 4900 2952 46B.tmp 96 PID 4900 wrote to memory of 4640 4900 565.tmp 97 PID 4640 wrote to memory of 4796 4640 6CC.tmp 98 PID 4796 wrote to memory of 1516 4796 7D6.tmp 99 PID 1516 wrote to memory of 4608 1516 91E.tmp 100 PID 4608 wrote to memory of 4396 4608 A08.tmp 101 PID 4396 wrote to memory of 708 4396 B12.tmp 102 PID 708 wrote to memory of 5084 708 C0C.tmp 103 PID 5084 wrote to memory of 3124 5084 D16.tmp 104 PID 3124 wrote to memory of 4860 3124 E10.tmp 105 PID 4860 wrote to memory of 3760 4860 F29.tmp 106 PID 3760 wrote to memory of 2988 3760 1023.tmp 107 PID 2988 wrote to memory of 252 2988 110D.tmp 108 PID 252 wrote to memory of 1480 252 1227.tmp 109 PID 1480 wrote to memory of 2976 1480 134F.tmp 110 PID 2976 wrote to memory of 1456 2976 1459.tmp 111 PID 1456 wrote to memory of 3156 1456 1572.tmp 112 PID 3156 wrote to memory of 3696 3156 167C.tmp 113 PID 3696 wrote to memory of 4820 3696 1786.tmp 114 PID 4820 wrote to memory of 4416 4820 1860.tmp 115 PID 4416 wrote to memory of 5268 4416 195A.tmp 116 PID 5268 wrote to memory of 1648 5268 1A45.tmp 117 PID 1648 wrote to memory of 1132 1648 1B10.tmp 118 PID 1132 wrote to memory of 6008 1132 1C68.tmp 119 PID 6008 wrote to memory of 2172 6008 1D71.tmp 120 PID 2172 wrote to memory of 4600 2172 1E8A.tmp 121 PID 4600 wrote to memory of 4452 4600 1F46.tmp 122 PID 4452 wrote to memory of 1664 4452 2021.tmp 123 PID 1664 wrote to memory of 2552 1664 20CD.tmp 124 PID 2552 wrote to memory of 4568 2552 2178.tmp 125 PID 4568 wrote to memory of 4768 4568 2215.tmp 126 PID 4768 wrote to memory of 4804 4768 22C1.tmp 127 PID 4804 wrote to memory of 1512 4804 234D.tmp 128 PID 1512 wrote to memory of 2248 1512 2418.tmp 129 PID 2248 wrote to memory of 1428 2248 24C4.tmp 130 PID 1428 wrote to memory of 2168 1428 2560.tmp 131 PID 2168 wrote to memory of 5712 2168 260C.tmp 132 PID 5712 wrote to memory of 3044 5712 26B8.tmp 133 PID 3044 wrote to memory of 2888 3044 2774.tmp 134 PID 2888 wrote to memory of 2864 2888 2820.tmp 135 PID 2864 wrote to memory of 2752 2864 28DB.tmp 136 PID 2752 wrote to memory of 2620 2752 2948.tmp 137 PID 2620 wrote to memory of 4336 2620 29D5.tmp 138 PID 4336 wrote to memory of 5156 4336 2A42.tmp 139 PID 5156 wrote to memory of 2444 5156 2ACF.tmp 140 PID 2444 wrote to memory of 6072 2444 2B4C.tmp 141 PID 6072 wrote to memory of 4264 6072 2BC9.tmp 142 PID 4264 wrote to memory of 5012 4264 2C46.tmp 143 PID 5012 wrote to memory of 5400 5012 2CC3.tmp 144 PID 5400 wrote to memory of 4120 5400 2D40.tmp 145 PID 4120 wrote to memory of 1680 4120 2DCD.tmp 146 PID 1680 wrote to memory of 1504 1680 2E4A.tmp 147 PID 1504 wrote to memory of 1976 1504 2EB7.tmp 148 PID 1976 wrote to memory of 2432 1976 2F24.tmp 149 PID 2432 wrote to memory of 3592 2432 2FB1.tmp 150 PID 3592 wrote to memory of 3316 3592 303E.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_509483461d519fd4a2d06dbeb467a948_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_509483461d519fd4a2d06dbeb467a948_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\FDD3.tmp"C:\Users\Admin\AppData\Local\Temp\FDD3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\FEED.tmp"C:\Users\Admin\AppData\Local\Temp\FEED.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\FFE7.tmp"C:\Users\Admin\AppData\Local\Temp\FFE7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\11F.tmp"C:\Users\Admin\AppData\Local\Temp\11F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\1AC.tmp"C:\Users\Admin\AppData\Local\Temp\1AC.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\229.tmp"C:\Users\Admin\AppData\Local\Temp\229.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\371.tmp"C:\Users\Admin\AppData\Local\Temp\371.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\46B.tmp"C:\Users\Admin\AppData\Local\Temp\46B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\565.tmp"C:\Users\Admin\AppData\Local\Temp\565.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\6CC.tmp"C:\Users\Admin\AppData\Local\Temp\6CC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\7D6.tmp"C:\Users\Admin\AppData\Local\Temp\7D6.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\91E.tmp"C:\Users\Admin\AppData\Local\Temp\91E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\A08.tmp"C:\Users\Admin\AppData\Local\Temp\A08.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\B12.tmp"C:\Users\Admin\AppData\Local\Temp\B12.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\C0C.tmp"C:\Users\Admin\AppData\Local\Temp\C0C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\D16.tmp"C:\Users\Admin\AppData\Local\Temp\D16.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\E10.tmp"C:\Users\Admin\AppData\Local\Temp\E10.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\F29.tmp"C:\Users\Admin\AppData\Local\Temp\F29.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\1023.tmp"C:\Users\Admin\AppData\Local\Temp\1023.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\110D.tmp"C:\Users\Admin\AppData\Local\Temp\110D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\1227.tmp"C:\Users\Admin\AppData\Local\Temp\1227.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\134F.tmp"C:\Users\Admin\AppData\Local\Temp\134F.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\1459.tmp"C:\Users\Admin\AppData\Local\Temp\1459.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\1572.tmp"C:\Users\Admin\AppData\Local\Temp\1572.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\167C.tmp"C:\Users\Admin\AppData\Local\Temp\167C.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\1786.tmp"C:\Users\Admin\AppData\Local\Temp\1786.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\1860.tmp"C:\Users\Admin\AppData\Local\Temp\1860.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\1A45.tmp"C:\Users\Admin\AppData\Local\Temp\1A45.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\1B10.tmp"C:\Users\Admin\AppData\Local\Temp\1B10.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\1C68.tmp"C:\Users\Admin\AppData\Local\Temp\1C68.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\1D71.tmp"C:\Users\Admin\AppData\Local\Temp\1D71.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\1F46.tmp"C:\Users\Admin\AppData\Local\Temp\1F46.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\2021.tmp"C:\Users\Admin\AppData\Local\Temp\2021.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\20CD.tmp"C:\Users\Admin\AppData\Local\Temp\20CD.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\2178.tmp"C:\Users\Admin\AppData\Local\Temp\2178.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\2215.tmp"C:\Users\Admin\AppData\Local\Temp\2215.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\22C1.tmp"C:\Users\Admin\AppData\Local\Temp\22C1.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\234D.tmp"C:\Users\Admin\AppData\Local\Temp\234D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\2418.tmp"C:\Users\Admin\AppData\Local\Temp\2418.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\24C4.tmp"C:\Users\Admin\AppData\Local\Temp\24C4.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\2560.tmp"C:\Users\Admin\AppData\Local\Temp\2560.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\260C.tmp"C:\Users\Admin\AppData\Local\Temp\260C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\26B8.tmp"C:\Users\Admin\AppData\Local\Temp\26B8.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\2774.tmp"C:\Users\Admin\AppData\Local\Temp\2774.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\2820.tmp"C:\Users\Admin\AppData\Local\Temp\2820.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\28DB.tmp"C:\Users\Admin\AppData\Local\Temp\28DB.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\2948.tmp"C:\Users\Admin\AppData\Local\Temp\2948.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\29D5.tmp"C:\Users\Admin\AppData\Local\Temp\29D5.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\2A42.tmp"C:\Users\Admin\AppData\Local\Temp\2A42.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"C:\Users\Admin\AppData\Local\Temp\2B4C.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\2BC9.tmp"C:\Users\Admin\AppData\Local\Temp\2BC9.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\2C46.tmp"C:\Users\Admin\AppData\Local\Temp\2C46.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\2CC3.tmp"C:\Users\Admin\AppData\Local\Temp\2CC3.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\2D40.tmp"C:\Users\Admin\AppData\Local\Temp\2D40.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\2DCD.tmp"C:\Users\Admin\AppData\Local\Temp\2DCD.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\2E4A.tmp"C:\Users\Admin\AppData\Local\Temp\2E4A.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\2F24.tmp"C:\Users\Admin\AppData\Local\Temp\2F24.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\303E.tmp"C:\Users\Admin\AppData\Local\Temp\303E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\30BB.tmp"C:\Users\Admin\AppData\Local\Temp\30BB.tmp"65⤵
- Executes dropped EXE
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\3157.tmp"C:\Users\Admin\AppData\Local\Temp\3157.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\31C4.tmp"C:\Users\Admin\AppData\Local\Temp\31C4.tmp"67⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\3251.tmp"C:\Users\Admin\AppData\Local\Temp\3251.tmp"68⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\32DE.tmp"C:\Users\Admin\AppData\Local\Temp\32DE.tmp"69⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\335B.tmp"C:\Users\Admin\AppData\Local\Temp\335B.tmp"70⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\33D8.tmp"C:\Users\Admin\AppData\Local\Temp\33D8.tmp"71⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\3464.tmp"C:\Users\Admin\AppData\Local\Temp\3464.tmp"72⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\34E1.tmp"C:\Users\Admin\AppData\Local\Temp\34E1.tmp"73⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\355E.tmp"C:\Users\Admin\AppData\Local\Temp\355E.tmp"74⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\35DB.tmp"C:\Users\Admin\AppData\Local\Temp\35DB.tmp"75⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\3677.tmp"C:\Users\Admin\AppData\Local\Temp\3677.tmp"76⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\3704.tmp"C:\Users\Admin\AppData\Local\Temp\3704.tmp"77⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\3791.tmp"C:\Users\Admin\AppData\Local\Temp\3791.tmp"78⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\380E.tmp"C:\Users\Admin\AppData\Local\Temp\380E.tmp"79⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\389A.tmp"C:\Users\Admin\AppData\Local\Temp\389A.tmp"80⤵PID:360
-
C:\Users\Admin\AppData\Local\Temp\3917.tmp"C:\Users\Admin\AppData\Local\Temp\3917.tmp"81⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\3994.tmp"C:\Users\Admin\AppData\Local\Temp\3994.tmp"82⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\3A11.tmp"C:\Users\Admin\AppData\Local\Temp\3A11.tmp"83⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\3A8E.tmp"C:\Users\Admin\AppData\Local\Temp\3A8E.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"85⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\3B98.tmp"C:\Users\Admin\AppData\Local\Temp\3B98.tmp"86⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\3C05.tmp"C:\Users\Admin\AppData\Local\Temp\3C05.tmp"87⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\3C92.tmp"C:\Users\Admin\AppData\Local\Temp\3C92.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\3D0F.tmp"C:\Users\Admin\AppData\Local\Temp\3D0F.tmp"89⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"90⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\3E28.tmp"C:\Users\Admin\AppData\Local\Temp\3E28.tmp"91⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\3EA5.tmp"C:\Users\Admin\AppData\Local\Temp\3EA5.tmp"92⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"93⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\405B.tmp"C:\Users\Admin\AppData\Local\Temp\405B.tmp"95⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\40D8.tmp"C:\Users\Admin\AppData\Local\Temp\40D8.tmp"96⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\4155.tmp"C:\Users\Admin\AppData\Local\Temp\4155.tmp"97⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\41D2.tmp"C:\Users\Admin\AppData\Local\Temp\41D2.tmp"98⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\425E.tmp"C:\Users\Admin\AppData\Local\Temp\425E.tmp"99⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\42DB.tmp"C:\Users\Admin\AppData\Local\Temp\42DB.tmp"100⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\4358.tmp"C:\Users\Admin\AppData\Local\Temp\4358.tmp"101⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\43E5.tmp"C:\Users\Admin\AppData\Local\Temp\43E5.tmp"102⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\4472.tmp"C:\Users\Admin\AppData\Local\Temp\4472.tmp"103⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\44FE.tmp"C:\Users\Admin\AppData\Local\Temp\44FE.tmp"104⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\456C.tmp"C:\Users\Admin\AppData\Local\Temp\456C.tmp"105⤵PID:5276
-
C:\Users\Admin\AppData\Local\Temp\45F8.tmp"C:\Users\Admin\AppData\Local\Temp\45F8.tmp"106⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\4675.tmp"C:\Users\Admin\AppData\Local\Temp\4675.tmp"107⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\4702.tmp"C:\Users\Admin\AppData\Local\Temp\4702.tmp"108⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\477F.tmp"C:\Users\Admin\AppData\Local\Temp\477F.tmp"109⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\480B.tmp"C:\Users\Admin\AppData\Local\Temp\480B.tmp"110⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\4888.tmp"C:\Users\Admin\AppData\Local\Temp\4888.tmp"111⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\4915.tmp"C:\Users\Admin\AppData\Local\Temp\4915.tmp"112⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\49A2.tmp"C:\Users\Admin\AppData\Local\Temp\49A2.tmp"113⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"114⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\4ABB.tmp"C:\Users\Admin\AppData\Local\Temp\4ABB.tmp"115⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\4B28.tmp"C:\Users\Admin\AppData\Local\Temp\4B28.tmp"116⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\4BB5.tmp"C:\Users\Admin\AppData\Local\Temp\4BB5.tmp"117⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\4C42.tmp"C:\Users\Admin\AppData\Local\Temp\4C42.tmp"118⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"119⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\4D3C.tmp"C:\Users\Admin\AppData\Local\Temp\4D3C.tmp"120⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\4DC8.tmp"C:\Users\Admin\AppData\Local\Temp\4DC8.tmp"121⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\4E45.tmp"C:\Users\Admin\AppData\Local\Temp\4E45.tmp"122⤵PID:2720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-