Analysis
- max time kernel
120s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 21:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_97b316362c44452838cfacd3a84f72aa_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_97b316362c44452838cfacd3a84f72aa_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-23_97b316362c44452838cfacd3a84f72aa_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260723-1cn5bsv1ex
- SHA256 69caa8eef9095b5c438b5c56b3a7441920cfe30ee56613c57d97ae0307dda564
- MD5 97b316362c44452838cfacd3a84f72aa
- SHA1 761b9369b9051b1070f3bd5a72898ea3280df654
- SHA512 3716784d20152a9722c96028f3ffd15ba2d3aebf99a9bff52b30231f8a5bb344fac168f25b0a18c5da6d6c19db10c1b230204fcf93ac6370171692aba0339fbe
- SSDEEP 12288:NU5rCOTeijNtPCTaS+90WgCQosP6ckMTZwlH:NUQOJjuaSKgCNsybMTSlH
- TLSH T160B4F122B681C132E69202714AE6EBB16A3F7C354726A4C73BD0666E2FB57D1D335307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4808 1B3F.tmp 4028 1D33.tmp 2516 1E3C.tmp 2404 1EF8.tmp 5468 1FB3.tmp 4412 206F.tmp 6052 20FB.tmp 5892 2188.tmp 3008 2224.tmp 5436 22FF.tmp 5140 23DA.tmp 2212 2486.tmp 5556 2522.tmp 248 25AF.tmp 1352 2689.tmp 1852 2716.tmp 4860 2793.tmp 5784 2820.tmp 2620 28AC.tmp 4288 2968.tmp 1416 2A14.tmp 5300 2ADF.tmp 2676 2B9A.tmp 4292 2C46.tmp 3408 2CF2.tmp 828 2DAD.tmp 1528 2E69.tmp 916 2F05.tmp 3700 2F92.tmp 3516 302E.tmp 4872 30BB.tmp 2708 3186.tmp 716 3261.tmp 3544 32ED.tmp 2052 337A.tmp 5580 3416.tmp 5192 3493.tmp 4144 3520.tmp 4840 359D.tmp 1888 3639.tmp 1148 36D5.tmp 5844 3762.tmp 2784 381D.tmp 6032 38AA.tmp 4220 3917.tmp 4852 3985.tmp 564 39F2.tmp 1396 3A6F.tmp 5364 3ADC.tmp 988 3B69.tmp 1136 3C05.tmp 5248 3C73.tmp 3744 3D0F.tmp 1432 3D9C.tmp 5368 3E57.tmp 1180 3EE4.tmp 3828 3F61.tmp 4100 3FED.tmp 4624 406A.tmp 6028 40E7.tmp 1008 4193.tmp 5384 422F.tmp 1144 42AC.tmp 3440 4349.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B74B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ACA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 188A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9154.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 485.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9462.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C104.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A097.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D718.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9282.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 478E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 675B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5351.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9205.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7706.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C22D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 625A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3922.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2486.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D76.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4856 wrote to memory of 4808 4856 2026-07-23_97b316362c44452838cfacd3a84f72aa_elex_mafia_stealc_tofsee.exe 89 PID 4808 wrote to memory of 4028 4808 1B3F.tmp 90 PID 4028 wrote to memory of 2516 4028 1D33.tmp 91 PID 2516 wrote to memory of 2404 2516 1E3C.tmp 92 PID 2404 wrote to memory of 5468 2404 1EF8.tmp 93 PID 5468 wrote to memory of 4412 5468 1FB3.tmp 94 PID 4412 wrote to memory of 6052 4412 206F.tmp 95 PID 6052 wrote to memory of 5892 6052 20FB.tmp 96 PID 5892 wrote to memory of 3008 5892 2188.tmp 97 PID 3008 wrote to memory of 5436 3008 2224.tmp 98 PID 5436 wrote to memory of 5140 5436 22FF.tmp 99 PID 5140 wrote to memory of 2212 5140 23DA.tmp 100 PID 2212 wrote to memory of 5556 2212 2486.tmp 101 PID 5556 wrote to memory of 248 5556 2522.tmp 102 PID 248 wrote to memory of 1352 248 25AF.tmp 103 PID 1352 wrote to memory of 1852 1352 2689.tmp 104 PID 1852 wrote to memory of 4860 1852 2716.tmp 105 PID 4860 wrote to memory of 5784 4860 2793.tmp 106 PID 5784 wrote to memory of 2620 5784 2820.tmp 107 PID 2620 wrote to memory of 4288 2620 28AC.tmp 108 PID 4288 wrote to memory of 1416 4288 2968.tmp 109 PID 1416 wrote to memory of 5300 1416 2A14.tmp 110 PID 5300 wrote to memory of 2676 5300 2ADF.tmp 111 PID 2676 wrote to memory of 4292 2676 2B9A.tmp 112 PID 4292 wrote to memory of 3408 4292 2C46.tmp 113 PID 3408 wrote to memory of 828 3408 2CF2.tmp 114 PID 828 wrote to memory of 1528 828 2DAD.tmp 115 PID 1528 wrote to memory of 916 1528 2E69.tmp 116 PID 916 wrote to memory of 3700 916 2F05.tmp 117 PID 3700 wrote to memory of 3516 3700 2F92.tmp 118 PID 3516 wrote to memory of 4872 3516 302E.tmp 119 PID 4872 wrote to memory of 2708 4872 30BB.tmp 120 PID 2708 wrote to memory of 716 2708 3186.tmp 121 PID 716 wrote to memory of 3544 716 3261.tmp 122 PID 3544 wrote to memory of 2052 3544 32ED.tmp 123 PID 2052 wrote to memory of 5580 2052 337A.tmp 124 PID 5580 wrote to memory of 5192 5580 3416.tmp 125 PID 5192 wrote to memory of 4144 5192 3493.tmp 126 PID 4144 wrote to memory of 4840 4144 3520.tmp 127 PID 4840 wrote to memory of 1888 4840 359D.tmp 128 PID 1888 wrote to memory of 1148 1888 3639.tmp 129 PID 1148 wrote to memory of 5844 1148 36D5.tmp 130 PID 5844 wrote to memory of 2784 5844 3762.tmp 131 PID 2784 wrote to memory of 6032 2784 381D.tmp 132 PID 6032 wrote to memory of 4220 6032 38AA.tmp 133 PID 4220 wrote to memory of 4852 4220 3917.tmp 134 PID 4852 wrote to memory of 564 4852 3985.tmp 135 PID 564 wrote to memory of 1396 564 39F2.tmp 136 PID 1396 wrote to memory of 5364 1396 3A6F.tmp 137 PID 5364 wrote to memory of 988 5364 3ADC.tmp 138 PID 988 wrote to memory of 1136 988 3B69.tmp 139 PID 1136 wrote to memory of 5248 1136 3C05.tmp 140 PID 5248 wrote to memory of 3744 5248 3C73.tmp 141 PID 3744 wrote to memory of 1432 3744 3D0F.tmp 142 PID 1432 wrote to memory of 5368 1432 3D9C.tmp 143 PID 5368 wrote to memory of 1180 5368 3E57.tmp 144 PID 1180 wrote to memory of 3828 1180 3EE4.tmp 145 PID 3828 wrote to memory of 4100 3828 3F61.tmp 146 PID 4100 wrote to memory of 4624 4100 3FED.tmp 147 PID 4624 wrote to memory of 6028 4624 406A.tmp 148 PID 6028 wrote to memory of 1008 6028 40E7.tmp 149 PID 1008 wrote to memory of 5384 1008 4193.tmp 150 PID 5384 wrote to memory of 1144 5384 422F.tmp 151 PID 1144 wrote to memory of 3440 1144 42AC.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_97b316362c44452838cfacd3a84f72aa_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_97b316362c44452838cfacd3a84f72aa_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\1D33.tmp"C:\Users\Admin\AppData\Local\Temp\1D33.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\1EF8.tmp"C:\Users\Admin\AppData\Local\Temp\1EF8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\1FB3.tmp"C:\Users\Admin\AppData\Local\Temp\1FB3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Users\Admin\AppData\Local\Temp\206F.tmp"C:\Users\Admin\AppData\Local\Temp\206F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\20FB.tmp"C:\Users\Admin\AppData\Local\Temp\20FB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6052 -
C:\Users\Admin\AppData\Local\Temp\2188.tmp"C:\Users\Admin\AppData\Local\Temp\2188.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\2224.tmp"C:\Users\Admin\AppData\Local\Temp\2224.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\22FF.tmp"C:\Users\Admin\AppData\Local\Temp\22FF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\23DA.tmp"C:\Users\Admin\AppData\Local\Temp\23DA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\2486.tmp"C:\Users\Admin\AppData\Local\Temp\2486.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\2522.tmp"C:\Users\Admin\AppData\Local\Temp\2522.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\25AF.tmp"C:\Users\Admin\AppData\Local\Temp\25AF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\2689.tmp"C:\Users\Admin\AppData\Local\Temp\2689.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\2716.tmp"C:\Users\Admin\AppData\Local\Temp\2716.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\2793.tmp"C:\Users\Admin\AppData\Local\Temp\2793.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\2820.tmp"C:\Users\Admin\AppData\Local\Temp\2820.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\28AC.tmp"C:\Users\Admin\AppData\Local\Temp\28AC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\2968.tmp"C:\Users\Admin\AppData\Local\Temp\2968.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\2A14.tmp"C:\Users\Admin\AppData\Local\Temp\2A14.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\2ADF.tmp"C:\Users\Admin\AppData\Local\Temp\2ADF.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\2B9A.tmp"C:\Users\Admin\AppData\Local\Temp\2B9A.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\2C46.tmp"C:\Users\Admin\AppData\Local\Temp\2C46.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\2CF2.tmp"C:\Users\Admin\AppData\Local\Temp\2CF2.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"C:\Users\Admin\AppData\Local\Temp\2DAD.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\2E69.tmp"C:\Users\Admin\AppData\Local\Temp\2E69.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\2F05.tmp"C:\Users\Admin\AppData\Local\Temp\2F05.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\2F92.tmp"C:\Users\Admin\AppData\Local\Temp\2F92.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\302E.tmp"C:\Users\Admin\AppData\Local\Temp\302E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\30BB.tmp"C:\Users\Admin\AppData\Local\Temp\30BB.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\3186.tmp"C:\Users\Admin\AppData\Local\Temp\3186.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\3261.tmp"C:\Users\Admin\AppData\Local\Temp\3261.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\32ED.tmp"C:\Users\Admin\AppData\Local\Temp\32ED.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\337A.tmp"C:\Users\Admin\AppData\Local\Temp\337A.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\3416.tmp"C:\Users\Admin\AppData\Local\Temp\3416.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\3493.tmp"C:\Users\Admin\AppData\Local\Temp\3493.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Users\Admin\AppData\Local\Temp\3520.tmp"C:\Users\Admin\AppData\Local\Temp\3520.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\359D.tmp"C:\Users\Admin\AppData\Local\Temp\359D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\3639.tmp"C:\Users\Admin\AppData\Local\Temp\3639.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\36D5.tmp"C:\Users\Admin\AppData\Local\Temp\36D5.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\3762.tmp"C:\Users\Admin\AppData\Local\Temp\3762.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\381D.tmp"C:\Users\Admin\AppData\Local\Temp\381D.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\38AA.tmp"C:\Users\Admin\AppData\Local\Temp\38AA.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\3917.tmp"C:\Users\Admin\AppData\Local\Temp\3917.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\3985.tmp"C:\Users\Admin\AppData\Local\Temp\3985.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\39F2.tmp"C:\Users\Admin\AppData\Local\Temp\39F2.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\3ADC.tmp"C:\Users\Admin\AppData\Local\Temp\3ADC.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\3B69.tmp"C:\Users\Admin\AppData\Local\Temp\3B69.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\3C05.tmp"C:\Users\Admin\AppData\Local\Temp\3C05.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\3C73.tmp"C:\Users\Admin\AppData\Local\Temp\3C73.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\3D0F.tmp"C:\Users\Admin\AppData\Local\Temp\3D0F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\3E57.tmp"C:\Users\Admin\AppData\Local\Temp\3E57.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\4193.tmp"C:\Users\Admin\AppData\Local\Temp\4193.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\422F.tmp"C:\Users\Admin\AppData\Local\Temp\422F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\42AC.tmp"C:\Users\Admin\AppData\Local\Temp\42AC.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\4349.tmp"C:\Users\Admin\AppData\Local\Temp\4349.tmp"65⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\43D5.tmp"C:\Users\Admin\AppData\Local\Temp\43D5.tmp"66⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\4443.tmp"C:\Users\Admin\AppData\Local\Temp\4443.tmp"67⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\44DF.tmp"C:\Users\Admin\AppData\Local\Temp\44DF.tmp"68⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\455C.tmp"C:\Users\Admin\AppData\Local\Temp\455C.tmp"69⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\4608.tmp"C:\Users\Admin\AppData\Local\Temp\4608.tmp"70⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\4694.tmp"C:\Users\Admin\AppData\Local\Temp\4694.tmp"71⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\4721.tmp"C:\Users\Admin\AppData\Local\Temp\4721.tmp"72⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\478E.tmp"C:\Users\Admin\AppData\Local\Temp\478E.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\47FC.tmp"C:\Users\Admin\AppData\Local\Temp\47FC.tmp"74⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\4888.tmp"C:\Users\Admin\AppData\Local\Temp\4888.tmp"75⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\4915.tmp"C:\Users\Admin\AppData\Local\Temp\4915.tmp"76⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\4982.tmp"C:\Users\Admin\AppData\Local\Temp\4982.tmp"77⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\49F0.tmp"C:\Users\Admin\AppData\Local\Temp\49F0.tmp"78⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\4AEA.tmp"C:\Users\Admin\AppData\Local\Temp\4AEA.tmp"80⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\4B67.tmp"C:\Users\Admin\AppData\Local\Temp\4B67.tmp"81⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\4BE4.tmp"C:\Users\Admin\AppData\Local\Temp\4BE4.tmp"82⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\4C51.tmp"C:\Users\Admin\AppData\Local\Temp\4C51.tmp"83⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\4CCE.tmp"C:\Users\Admin\AppData\Local\Temp\4CCE.tmp"84⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\4D4B.tmp"C:\Users\Admin\AppData\Local\Temp\4D4B.tmp"85⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\4DB9.tmp"C:\Users\Admin\AppData\Local\Temp\4DB9.tmp"86⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\4E26.tmp"C:\Users\Admin\AppData\Local\Temp\4E26.tmp"87⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\4EB3.tmp"C:\Users\Admin\AppData\Local\Temp\4EB3.tmp"88⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\4F30.tmp"C:\Users\Admin\AppData\Local\Temp\4F30.tmp"89⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\4FBC.tmp"C:\Users\Admin\AppData\Local\Temp\4FBC.tmp"90⤵PID:5376
-
C:\Users\Admin\AppData\Local\Temp\5049.tmp"C:\Users\Admin\AppData\Local\Temp\5049.tmp"91⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\50C6.tmp"C:\Users\Admin\AppData\Local\Temp\50C6.tmp"92⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\5152.tmp"C:\Users\Admin\AppData\Local\Temp\5152.tmp"93⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\51DF.tmp"C:\Users\Admin\AppData\Local\Temp\51DF.tmp"94⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\527B.tmp"C:\Users\Admin\AppData\Local\Temp\527B.tmp"95⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\5308.tmp"C:\Users\Admin\AppData\Local\Temp\5308.tmp"96⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\5375.tmp"C:\Users\Admin\AppData\Local\Temp\5375.tmp"97⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\5402.tmp"C:\Users\Admin\AppData\Local\Temp\5402.tmp"98⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\549E.tmp"C:\Users\Admin\AppData\Local\Temp\549E.tmp"99⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\551B.tmp"C:\Users\Admin\AppData\Local\Temp\551B.tmp"100⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\55A8.tmp"C:\Users\Admin\AppData\Local\Temp\55A8.tmp"101⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\5634.tmp"C:\Users\Admin\AppData\Local\Temp\5634.tmp"102⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\56B1.tmp"C:\Users\Admin\AppData\Local\Temp\56B1.tmp"103⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\571F.tmp"C:\Users\Admin\AppData\Local\Temp\571F.tmp"104⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\57CB.tmp"C:\Users\Admin\AppData\Local\Temp\57CB.tmp"105⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\5857.tmp"C:\Users\Admin\AppData\Local\Temp\5857.tmp"106⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\58F4.tmp"C:\Users\Admin\AppData\Local\Temp\58F4.tmp"107⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\5971.tmp"C:\Users\Admin\AppData\Local\Temp\5971.tmp"108⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\59FD.tmp"C:\Users\Admin\AppData\Local\Temp\59FD.tmp"109⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"110⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\5B16.tmp"C:\Users\Admin\AppData\Local\Temp\5B16.tmp"111⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\5B93.tmp"C:\Users\Admin\AppData\Local\Temp\5B93.tmp"112⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\5C20.tmp"C:\Users\Admin\AppData\Local\Temp\5C20.tmp"113⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\5CAD.tmp"C:\Users\Admin\AppData\Local\Temp\5CAD.tmp"114⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\5D2A.tmp"C:\Users\Admin\AppData\Local\Temp\5D2A.tmp"115⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\5DA7.tmp"C:\Users\Admin\AppData\Local\Temp\5DA7.tmp"116⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\5E33.tmp"C:\Users\Admin\AppData\Local\Temp\5E33.tmp"117⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\5EA1.tmp"C:\Users\Admin\AppData\Local\Temp\5EA1.tmp"118⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\5F1E.tmp"C:\Users\Admin\AppData\Local\Temp\5F1E.tmp"119⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\5FCA.tmp"C:\Users\Admin\AppData\Local\Temp\5FCA.tmp"120⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\6047.tmp"C:\Users\Admin\AppData\Local\Temp\6047.tmp"121⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\60D3.tmp"C:\Users\Admin\AppData\Local\Temp\60D3.tmp"122⤵PID:2792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-