Analysis
- max time kernel
130s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 01:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-19_8585f4924dbdd3243a2f6b5631023f9a_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_8585f4924dbdd3243a2f6b5631023f9a_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-07-19_8585f4924dbdd3243a2f6b5631023f9a_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260720-bf23xsdv7x
- SHA256 f83198e5637566d782706f6a67e2f0c8b6497839e35758fd674e0a069b8b6420
- MD5 8585f4924dbdd3243a2f6b5631023f9a
- SHA1 ef6881c3cbb3e39b6eb2ea957dddecfe527d7b9f
- SHA512 d2dce04a5e4a268c040b9cd5aa83bc111fa8c2eea7b3d6c36b9da22b293b5ea79386a6ff426b744beb54d7a8e6fbf0adb0a1ef6941bcdec039aa1c024ce2f340
- SSDEEP 12288:9U5rCOTei6EuuoFTh5sphORwauezx+pCwqZoXWjdq:9UQOJ6EPgThGEw1eccwqqGh
- TLSH T1C8C401257588C032E59212354FE6EB716A7A7C359B2260CB7B80776E6FB12E1E734307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2724 3186.tmp 3328 3241.tmp 4884 331C.tmp 5848 33D8.tmp 1444 3483.tmp 1948 34F1.tmp 3120 35DB.tmp 4120 36A6.tmp 3540 3743.tmp 5988 383D.tmp 4596 3965.tmp 4772 3A02.tmp 120 3ABD.tmp 3908 3B69.tmp 2508 3C34.tmp 1908 3CC1.tmp 5644 3D7C.tmp 2688 3E57.tmp 5160 3ED4.tmp 1176 3F80.tmp 4800 401C.tmp 6032 4099.tmp 5652 4184.tmp 5900 425E.tmp 1128 42DB.tmp 1540 4378.tmp 3272 4443.tmp 2616 44FE.tmp 5016 459A.tmp 2224 4646.tmp 5452 46C3.tmp 5460 4760.tmp 1400 47FC.tmp 560 4879.tmp 2444 4905.tmp 3024 4982.tmp 760 49FF.tmp 4576 4A6D.tmp 4520 4AEA.tmp 2408 4B67.tmp 3320 4BE4.tmp 5448 4C61.tmp 3240 4CDE.tmp 1696 4D5B.tmp 3288 4DC8.tmp 4812 4E55.tmp 5640 4EC2.tmp 5984 4F4F.tmp 5152 4FAD.tmp 3380 501A.tmp 4852 50A7.tmp 2484 5114.tmp 700 5191.tmp 5708 521E.tmp 6012 529B.tmp 5836 52F8.tmp 5588 5366.tmp 1844 5412.tmp 3136 547F.tmp 5100 550C.tmp 1988 5598.tmp 4256 5615.tmp 4268 5692.tmp 2672 570F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 416F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 696E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6874.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7620.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8108.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E09D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 521E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 275B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7929.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E11A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F790.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1137.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4760.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8469.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 869B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6468.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B613.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 109B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6217.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D747.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B05B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B47C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F379.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 188.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 550C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2724 2884 2026-07-19_8585f4924dbdd3243a2f6b5631023f9a_elex_mafia_stealc_tofsee.exe 89 PID 2724 wrote to memory of 3328 2724 3186.tmp 90 PID 3328 wrote to memory of 4884 3328 3241.tmp 91 PID 4884 wrote to memory of 5848 4884 331C.tmp 92 PID 5848 wrote to memory of 1444 5848 33D8.tmp 93 PID 1444 wrote to memory of 1948 1444 3483.tmp 94 PID 1948 wrote to memory of 3120 1948 34F1.tmp 95 PID 3120 wrote to memory of 4120 3120 35DB.tmp 96 PID 4120 wrote to memory of 3540 4120 36A6.tmp 97 PID 3540 wrote to memory of 5988 3540 3743.tmp 98 PID 5988 wrote to memory of 4596 5988 383D.tmp 99 PID 4596 wrote to memory of 4772 4596 3965.tmp 100 PID 4772 wrote to memory of 120 4772 3A02.tmp 101 PID 120 wrote to memory of 3908 120 3ABD.tmp 102 PID 3908 wrote to memory of 2508 3908 3B69.tmp 103 PID 2508 wrote to memory of 1908 2508 3C34.tmp 104 PID 1908 wrote to memory of 5644 1908 3CC1.tmp 105 PID 5644 wrote to memory of 2688 5644 3D7C.tmp 106 PID 2688 wrote to memory of 5160 2688 3E57.tmp 107 PID 5160 wrote to memory of 1176 5160 3ED4.tmp 108 PID 1176 wrote to memory of 4800 1176 3F80.tmp 109 PID 4800 wrote to memory of 6032 4800 401C.tmp 110 PID 6032 wrote to memory of 5652 6032 4099.tmp 111 PID 5652 wrote to memory of 5900 5652 4184.tmp 112 PID 5900 wrote to memory of 1128 5900 425E.tmp 113 PID 1128 wrote to memory of 1540 1128 42DB.tmp 114 PID 1540 wrote to memory of 3272 1540 4378.tmp 115 PID 3272 wrote to memory of 2616 3272 4443.tmp 116 PID 2616 wrote to memory of 5016 2616 44FE.tmp 117 PID 5016 wrote to memory of 2224 5016 459A.tmp 118 PID 2224 wrote to memory of 5452 2224 4646.tmp 119 PID 5452 wrote to memory of 5460 5452 46C3.tmp 120 PID 5460 wrote to memory of 1400 5460 4760.tmp 121 PID 1400 wrote to memory of 560 1400 47FC.tmp 122 PID 560 wrote to memory of 2444 560 4879.tmp 123 PID 2444 wrote to memory of 3024 2444 4905.tmp 124 PID 3024 wrote to memory of 760 3024 4982.tmp 125 PID 760 wrote to memory of 4576 760 49FF.tmp 126 PID 4576 wrote to memory of 4520 4576 4A6D.tmp 127 PID 4520 wrote to memory of 2408 4520 4AEA.tmp 128 PID 2408 wrote to memory of 3320 2408 4B67.tmp 129 PID 3320 wrote to memory of 5448 3320 4BE4.tmp 130 PID 5448 wrote to memory of 3240 5448 4C61.tmp 131 PID 3240 wrote to memory of 1696 3240 4CDE.tmp 132 PID 1696 wrote to memory of 3288 1696 4D5B.tmp 133 PID 3288 wrote to memory of 4812 3288 4DC8.tmp 134 PID 4812 wrote to memory of 5640 4812 4E55.tmp 135 PID 5640 wrote to memory of 5984 5640 4EC2.tmp 136 PID 5984 wrote to memory of 5152 5984 4F4F.tmp 137 PID 5152 wrote to memory of 3380 5152 4FAD.tmp 138 PID 3380 wrote to memory of 4852 3380 501A.tmp 139 PID 4852 wrote to memory of 2484 4852 50A7.tmp 140 PID 2484 wrote to memory of 700 2484 5114.tmp 141 PID 700 wrote to memory of 5708 700 5191.tmp 142 PID 5708 wrote to memory of 6012 5708 521E.tmp 143 PID 6012 wrote to memory of 5836 6012 529B.tmp 144 PID 5836 wrote to memory of 5588 5836 52F8.tmp 145 PID 5588 wrote to memory of 1844 5588 5366.tmp 146 PID 1844 wrote to memory of 3136 1844 5412.tmp 147 PID 3136 wrote to memory of 5100 3136 547F.tmp 148 PID 5100 wrote to memory of 1988 5100 550C.tmp 149 PID 1988 wrote to memory of 4256 1988 5598.tmp 150 PID 4256 wrote to memory of 4268 4256 5615.tmp 151 PID 4268 wrote to memory of 2672 4268 5692.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_8585f4924dbdd3243a2f6b5631023f9a_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_8585f4924dbdd3243a2f6b5631023f9a_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\3186.tmp"C:\Users\Admin\AppData\Local\Temp\3186.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\3241.tmp"C:\Users\Admin\AppData\Local\Temp\3241.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\331C.tmp"C:\Users\Admin\AppData\Local\Temp\331C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\33D8.tmp"C:\Users\Admin\AppData\Local\Temp\33D8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\3483.tmp"C:\Users\Admin\AppData\Local\Temp\3483.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\34F1.tmp"C:\Users\Admin\AppData\Local\Temp\34F1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\35DB.tmp"C:\Users\Admin\AppData\Local\Temp\35DB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\36A6.tmp"C:\Users\Admin\AppData\Local\Temp\36A6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\3743.tmp"C:\Users\Admin\AppData\Local\Temp\3743.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\383D.tmp"C:\Users\Admin\AppData\Local\Temp\383D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\3965.tmp"C:\Users\Admin\AppData\Local\Temp\3965.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\3A02.tmp"C:\Users\Admin\AppData\Local\Temp\3A02.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\3ABD.tmp"C:\Users\Admin\AppData\Local\Temp\3ABD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Users\Admin\AppData\Local\Temp\3B69.tmp"C:\Users\Admin\AppData\Local\Temp\3B69.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\3C34.tmp"C:\Users\Admin\AppData\Local\Temp\3C34.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\3CC1.tmp"C:\Users\Admin\AppData\Local\Temp\3CC1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"C:\Users\Admin\AppData\Local\Temp\3D7C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\3E57.tmp"C:\Users\Admin\AppData\Local\Temp\3E57.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"C:\Users\Admin\AppData\Local\Temp\3ED4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\4099.tmp"C:\Users\Admin\AppData\Local\Temp\4099.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\4184.tmp"C:\Users\Admin\AppData\Local\Temp\4184.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\425E.tmp"C:\Users\Admin\AppData\Local\Temp\425E.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\42DB.tmp"C:\Users\Admin\AppData\Local\Temp\42DB.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\4378.tmp"C:\Users\Admin\AppData\Local\Temp\4378.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\4443.tmp"C:\Users\Admin\AppData\Local\Temp\4443.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\44FE.tmp"C:\Users\Admin\AppData\Local\Temp\44FE.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\459A.tmp"C:\Users\Admin\AppData\Local\Temp\459A.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\4646.tmp"C:\Users\Admin\AppData\Local\Temp\4646.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\46C3.tmp"C:\Users\Admin\AppData\Local\Temp\46C3.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\4760.tmp"C:\Users\Admin\AppData\Local\Temp\4760.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\47FC.tmp"C:\Users\Admin\AppData\Local\Temp\47FC.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\4879.tmp"C:\Users\Admin\AppData\Local\Temp\4879.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\4905.tmp"C:\Users\Admin\AppData\Local\Temp\4905.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\4982.tmp"C:\Users\Admin\AppData\Local\Temp\4982.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\49FF.tmp"C:\Users\Admin\AppData\Local\Temp\49FF.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\4AEA.tmp"C:\Users\Admin\AppData\Local\Temp\4AEA.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\4B67.tmp"C:\Users\Admin\AppData\Local\Temp\4B67.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\4BE4.tmp"C:\Users\Admin\AppData\Local\Temp\4BE4.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\4C61.tmp"C:\Users\Admin\AppData\Local\Temp\4C61.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\4CDE.tmp"C:\Users\Admin\AppData\Local\Temp\4CDE.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\4D5B.tmp"C:\Users\Admin\AppData\Local\Temp\4D5B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\4DC8.tmp"C:\Users\Admin\AppData\Local\Temp\4DC8.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\4E55.tmp"C:\Users\Admin\AppData\Local\Temp\4E55.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\4EC2.tmp"C:\Users\Admin\AppData\Local\Temp\4EC2.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\4F4F.tmp"C:\Users\Admin\AppData\Local\Temp\4F4F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\4FAD.tmp"C:\Users\Admin\AppData\Local\Temp\4FAD.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\501A.tmp"C:\Users\Admin\AppData\Local\Temp\501A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\50A7.tmp"C:\Users\Admin\AppData\Local\Temp\50A7.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\5114.tmp"C:\Users\Admin\AppData\Local\Temp\5114.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\5191.tmp"C:\Users\Admin\AppData\Local\Temp\5191.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\521E.tmp"C:\Users\Admin\AppData\Local\Temp\521E.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\529B.tmp"C:\Users\Admin\AppData\Local\Temp\529B.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\52F8.tmp"C:\Users\Admin\AppData\Local\Temp\52F8.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\5366.tmp"C:\Users\Admin\AppData\Local\Temp\5366.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\5412.tmp"C:\Users\Admin\AppData\Local\Temp\5412.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\547F.tmp"C:\Users\Admin\AppData\Local\Temp\547F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\550C.tmp"C:\Users\Admin\AppData\Local\Temp\550C.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\5598.tmp"C:\Users\Admin\AppData\Local\Temp\5598.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\5615.tmp"C:\Users\Admin\AppData\Local\Temp\5615.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\5692.tmp"C:\Users\Admin\AppData\Local\Temp\5692.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\570F.tmp"C:\Users\Admin\AppData\Local\Temp\570F.tmp"65⤵
- Executes dropped EXE
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\576D.tmp"C:\Users\Admin\AppData\Local\Temp\576D.tmp"66⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\57FA.tmp"C:\Users\Admin\AppData\Local\Temp\57FA.tmp"67⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\5857.tmp"C:\Users\Admin\AppData\Local\Temp\5857.tmp"68⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\58C5.tmp"C:\Users\Admin\AppData\Local\Temp\58C5.tmp"69⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\5932.tmp"C:\Users\Admin\AppData\Local\Temp\5932.tmp"70⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\59AF.tmp"C:\Users\Admin\AppData\Local\Temp\59AF.tmp"71⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\5A1C.tmp"C:\Users\Admin\AppData\Local\Temp\5A1C.tmp"72⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"73⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\5AE8.tmp"C:\Users\Admin\AppData\Local\Temp\5AE8.tmp"74⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\5B55.tmp"C:\Users\Admin\AppData\Local\Temp\5B55.tmp"75⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\5BD2.tmp"C:\Users\Admin\AppData\Local\Temp\5BD2.tmp"76⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\5C4F.tmp"C:\Users\Admin\AppData\Local\Temp\5C4F.tmp"77⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\5CCC.tmp"C:\Users\Admin\AppData\Local\Temp\5CCC.tmp"78⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\5D49.tmp"C:\Users\Admin\AppData\Local\Temp\5D49.tmp"79⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\5DD6.tmp"C:\Users\Admin\AppData\Local\Temp\5DD6.tmp"80⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\5E62.tmp"C:\Users\Admin\AppData\Local\Temp\5E62.tmp"81⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\5EEF.tmp"C:\Users\Admin\AppData\Local\Temp\5EEF.tmp"82⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\5F5C.tmp"C:\Users\Admin\AppData\Local\Temp\5F5C.tmp"83⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\5FE9.tmp"C:\Users\Admin\AppData\Local\Temp\5FE9.tmp"84⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\6085.tmp"C:\Users\Admin\AppData\Local\Temp\6085.tmp"85⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\6102.tmp"C:\Users\Admin\AppData\Local\Temp\6102.tmp"86⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\618F.tmp"C:\Users\Admin\AppData\Local\Temp\618F.tmp"87⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\620C.tmp"C:\Users\Admin\AppData\Local\Temp\620C.tmp"88⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\6279.tmp"C:\Users\Admin\AppData\Local\Temp\6279.tmp"89⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\6306.tmp"C:\Users\Admin\AppData\Local\Temp\6306.tmp"90⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\6383.tmp"C:\Users\Admin\AppData\Local\Temp\6383.tmp"91⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\6400.tmp"C:\Users\Admin\AppData\Local\Temp\6400.tmp"92⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\646D.tmp"C:\Users\Admin\AppData\Local\Temp\646D.tmp"93⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\64DA.tmp"C:\Users\Admin\AppData\Local\Temp\64DA.tmp"94⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\6557.tmp"C:\Users\Admin\AppData\Local\Temp\6557.tmp"95⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\65F4.tmp"C:\Users\Admin\AppData\Local\Temp\65F4.tmp"96⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"97⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\670D.tmp"C:\Users\Admin\AppData\Local\Temp\670D.tmp"98⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\677A.tmp"C:\Users\Admin\AppData\Local\Temp\677A.tmp"99⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"100⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\6874.tmp"C:\Users\Admin\AppData\Local\Temp\6874.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\68E2.tmp"C:\Users\Admin\AppData\Local\Temp\68E2.tmp"102⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\696E.tmp"C:\Users\Admin\AppData\Local\Temp\696E.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\69EB.tmp"C:\Users\Admin\AppData\Local\Temp\69EB.tmp"104⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\6A68.tmp"C:\Users\Admin\AppData\Local\Temp\6A68.tmp"105⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\6AE5.tmp"C:\Users\Admin\AppData\Local\Temp\6AE5.tmp"106⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\6B72.tmp"C:\Users\Admin\AppData\Local\Temp\6B72.tmp"107⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\6BDF.tmp"C:\Users\Admin\AppData\Local\Temp\6BDF.tmp"108⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\6C5C.tmp"C:\Users\Admin\AppData\Local\Temp\6C5C.tmp"109⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\6CCA.tmp"C:\Users\Admin\AppData\Local\Temp\6CCA.tmp"110⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\6D66.tmp"C:\Users\Admin\AppData\Local\Temp\6D66.tmp"111⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\6DE3.tmp"C:\Users\Admin\AppData\Local\Temp\6DE3.tmp"112⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\6E70.tmp"C:\Users\Admin\AppData\Local\Temp\6E70.tmp"113⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\6F0C.tmp"C:\Users\Admin\AppData\Local\Temp\6F0C.tmp"114⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\6F89.tmp"C:\Users\Admin\AppData\Local\Temp\6F89.tmp"115⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\6FF6.tmp"C:\Users\Admin\AppData\Local\Temp\6FF6.tmp"116⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\7083.tmp"C:\Users\Admin\AppData\Local\Temp\7083.tmp"117⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\70F0.tmp"C:\Users\Admin\AppData\Local\Temp\70F0.tmp"118⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\716D.tmp"C:\Users\Admin\AppData\Local\Temp\716D.tmp"119⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\71EA.tmp"C:\Users\Admin\AppData\Local\Temp\71EA.tmp"120⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\7258.tmp"C:\Users\Admin\AppData\Local\Temp\7258.tmp"121⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\72D5.tmp"C:\Users\Admin\AppData\Local\Temp\72D5.tmp"122⤵PID:3304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-