Analysis
- max time kernel
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 13:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_92d5c8fe9769462f649aeb4ded541790_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_92d5c8fe9769462f649aeb4ded541790_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-01_92d5c8fe9769462f649aeb4ded541790_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample260801-qkdnfsbb67
- SHA256 a5c7aac95fe6c8690b3b10e9cd73a73a053a6d9c091930c019a9d237cbd0cd09
- MD5 92d5c8fe9769462f649aeb4ded541790
- SHA1 0a35dd9a01833e45f196354c59321eb254f02c98
- SHA512 73f4d6cac31e4f74a7af87cbef586bf8f1c34c326d6daeac1c36b0670fbdaa91833f15481709cf8f862b7a58eaa3e3ab33645f2ab6b8f21985a693f5971d093d
- SSDEEP 12288:9U5rCOTei6/QphMMREIvw3bVB7fSYbIKwLqZoXWjdqpby1grA70G+o:9UQOJ6IpyAEPbF7wLqqGh4yATXo
- TLSH T128E40125B985C032E9D202308FE6EBB1697ABD31572164C77BC0A76E2FB12E19735347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4232 4358.tmp 4520 43E5.tmp 2252 44CF.tmp 5876 459A.tmp 760 4675.tmp 4268 4731.tmp 1308 47DD.tmp 1176 4888.tmp 1104 4915.tmp 6040 49D1.tmp 3044 4A9C.tmp 3428 4B48.tmp 5996 4C51.tmp 5848 4CFD.tmp 1736 4DC8.tmp 1576 4EA3.tmp 564 4F6E.tmp 2700 501A.tmp 468 5124.tmp 5048 51DF.tmp 2880 526C.tmp 1968 5356.tmp 4684 5402.tmp 2264 54CD.tmp 5312 55A8.tmp 3640 56C1.tmp 2064 578C.tmp 4284 5877.tmp 5292 5951.tmp 1084 5A0D.tmp 3060 5A8A.tmp 3844 5B65.tmp 1464 5C4F.tmp 2456 5CBC.tmp 3996 5D49.tmp 3548 5DC6.tmp 1468 5E43.tmp 2808 5ED0.tmp 5800 5F3D.tmp 5924 5FAA.tmp 860 6027.tmp 5880 60B4.tmp 3096 6141.tmp 2444 61AE.tmp 5716 624A.tmp 1584 62C7.tmp 3540 6354.tmp 2796 63E0.tmp 2676 645D.tmp 2608 64FA.tmp 688 6586.tmp 824 6623.tmp 3552 66DE.tmp 5620 675B.tmp 4848 67E8.tmp 5888 6865.tmp 956 68F1.tmp 2088 697E.tmp 4140 6A0B.tmp 5664 6AB6.tmp 1248 6B33.tmp 5944 6BB0.tmp 1772 6C1E.tmp 2076 6CAA.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F926.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 344B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E797.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9898.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 548A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B085.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1847.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2641.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 189A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9135.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 675B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4160.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 854E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E824.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8320.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A048.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B397.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F270.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F88A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 741D.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5860 wrote to memory of 4232 5860 2026-08-01_92d5c8fe9769462f649aeb4ded541790_elex_mafia_stealc_tofsee.exe 89 PID 4232 wrote to memory of 4520 4232 4358.tmp 90 PID 4520 wrote to memory of 2252 4520 43E5.tmp 91 PID 2252 wrote to memory of 5876 2252 44CF.tmp 92 PID 5876 wrote to memory of 760 5876 459A.tmp 93 PID 760 wrote to memory of 4268 760 4675.tmp 94 PID 4268 wrote to memory of 1308 4268 4731.tmp 95 PID 1308 wrote to memory of 1176 1308 47DD.tmp 96 PID 1176 wrote to memory of 1104 1176 4888.tmp 97 PID 1104 wrote to memory of 6040 1104 4915.tmp 98 PID 6040 wrote to memory of 3044 6040 49D1.tmp 99 PID 3044 wrote to memory of 3428 3044 4A9C.tmp 100 PID 3428 wrote to memory of 5996 3428 4B48.tmp 101 PID 5996 wrote to memory of 5848 5996 4C51.tmp 102 PID 5848 wrote to memory of 1736 5848 4CFD.tmp 103 PID 1736 wrote to memory of 1576 1736 4DC8.tmp 104 PID 1576 wrote to memory of 564 1576 4EA3.tmp 105 PID 564 wrote to memory of 2700 564 4F6E.tmp 106 PID 2700 wrote to memory of 468 2700 501A.tmp 107 PID 468 wrote to memory of 5048 468 5124.tmp 108 PID 5048 wrote to memory of 2880 5048 51DF.tmp 109 PID 2880 wrote to memory of 1968 2880 526C.tmp 110 PID 1968 wrote to memory of 4684 1968 5356.tmp 111 PID 4684 wrote to memory of 2264 4684 5402.tmp 112 PID 2264 wrote to memory of 5312 2264 54CD.tmp 113 PID 5312 wrote to memory of 3640 5312 55A8.tmp 114 PID 3640 wrote to memory of 2064 3640 56C1.tmp 115 PID 2064 wrote to memory of 4284 2064 578C.tmp 116 PID 4284 wrote to memory of 5292 4284 5877.tmp 117 PID 5292 wrote to memory of 1084 5292 5951.tmp 118 PID 1084 wrote to memory of 3060 1084 5A0D.tmp 119 PID 3060 wrote to memory of 3844 3060 5A8A.tmp 120 PID 3844 wrote to memory of 1464 3844 5B65.tmp 121 PID 1464 wrote to memory of 2456 1464 5C4F.tmp 122 PID 2456 wrote to memory of 3996 2456 5CBC.tmp 123 PID 3996 wrote to memory of 3548 3996 5D49.tmp 124 PID 3548 wrote to memory of 1468 3548 5DC6.tmp 125 PID 1468 wrote to memory of 2808 1468 5E43.tmp 126 PID 2808 wrote to memory of 5800 2808 5ED0.tmp 127 PID 5800 wrote to memory of 5924 5800 5F3D.tmp 128 PID 5924 wrote to memory of 860 5924 5FAA.tmp 129 PID 860 wrote to memory of 5880 860 6027.tmp 130 PID 5880 wrote to memory of 3096 5880 60B4.tmp 131 PID 3096 wrote to memory of 2444 3096 6141.tmp 132 PID 2444 wrote to memory of 5716 2444 61AE.tmp 133 PID 5716 wrote to memory of 1584 5716 624A.tmp 134 PID 1584 wrote to memory of 3540 1584 62C7.tmp 135 PID 3540 wrote to memory of 2796 3540 6354.tmp 136 PID 2796 wrote to memory of 2676 2796 63E0.tmp 137 PID 2676 wrote to memory of 2608 2676 645D.tmp 138 PID 2608 wrote to memory of 688 2608 64FA.tmp 139 PID 688 wrote to memory of 824 688 6586.tmp 140 PID 824 wrote to memory of 3552 824 6623.tmp 141 PID 3552 wrote to memory of 5620 3552 66DE.tmp 142 PID 5620 wrote to memory of 4848 5620 675B.tmp 143 PID 4848 wrote to memory of 5888 4848 67E8.tmp 144 PID 5888 wrote to memory of 956 5888 6865.tmp 145 PID 956 wrote to memory of 2088 956 68F1.tmp 146 PID 2088 wrote to memory of 4140 2088 697E.tmp 147 PID 4140 wrote to memory of 5664 4140 6A0B.tmp 148 PID 5664 wrote to memory of 1248 5664 6AB6.tmp 149 PID 1248 wrote to memory of 5944 1248 6B33.tmp 150 PID 5944 wrote to memory of 1772 5944 6BB0.tmp 151 PID 1772 wrote to memory of 2076 1772 6C1E.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_92d5c8fe9769462f649aeb4ded541790_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_92d5c8fe9769462f649aeb4ded541790_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\4358.tmp"C:\Users\Admin\AppData\Local\Temp\4358.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\43E5.tmp"C:\Users\Admin\AppData\Local\Temp\43E5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\44CF.tmp"C:\Users\Admin\AppData\Local\Temp\44CF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\459A.tmp"C:\Users\Admin\AppData\Local\Temp\459A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\4675.tmp"C:\Users\Admin\AppData\Local\Temp\4675.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\4731.tmp"C:\Users\Admin\AppData\Local\Temp\4731.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\47DD.tmp"C:\Users\Admin\AppData\Local\Temp\47DD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\4888.tmp"C:\Users\Admin\AppData\Local\Temp\4888.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\4915.tmp"C:\Users\Admin\AppData\Local\Temp\4915.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\49D1.tmp"C:\Users\Admin\AppData\Local\Temp\49D1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\4A9C.tmp"C:\Users\Admin\AppData\Local\Temp\4A9C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\4B48.tmp"C:\Users\Admin\AppData\Local\Temp\4B48.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\4C51.tmp"C:\Users\Admin\AppData\Local\Temp\4C51.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\4DC8.tmp"C:\Users\Admin\AppData\Local\Temp\4DC8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\4EA3.tmp"C:\Users\Admin\AppData\Local\Temp\4EA3.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\4F6E.tmp"C:\Users\Admin\AppData\Local\Temp\4F6E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\501A.tmp"C:\Users\Admin\AppData\Local\Temp\501A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\5124.tmp"C:\Users\Admin\AppData\Local\Temp\5124.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\51DF.tmp"C:\Users\Admin\AppData\Local\Temp\51DF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\526C.tmp"C:\Users\Admin\AppData\Local\Temp\526C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\5356.tmp"C:\Users\Admin\AppData\Local\Temp\5356.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\5402.tmp"C:\Users\Admin\AppData\Local\Temp\5402.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\54CD.tmp"C:\Users\Admin\AppData\Local\Temp\54CD.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\55A8.tmp"C:\Users\Admin\AppData\Local\Temp\55A8.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\56C1.tmp"C:\Users\Admin\AppData\Local\Temp\56C1.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\578C.tmp"C:\Users\Admin\AppData\Local\Temp\578C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\5877.tmp"C:\Users\Admin\AppData\Local\Temp\5877.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\5951.tmp"C:\Users\Admin\AppData\Local\Temp\5951.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\5A8A.tmp"C:\Users\Admin\AppData\Local\Temp\5A8A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\5B65.tmp"C:\Users\Admin\AppData\Local\Temp\5B65.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\5C4F.tmp"C:\Users\Admin\AppData\Local\Temp\5C4F.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\5CBC.tmp"C:\Users\Admin\AppData\Local\Temp\5CBC.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\5D49.tmp"C:\Users\Admin\AppData\Local\Temp\5D49.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"C:\Users\Admin\AppData\Local\Temp\5DC6.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\5E43.tmp"C:\Users\Admin\AppData\Local\Temp\5E43.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\5ED0.tmp"C:\Users\Admin\AppData\Local\Temp\5ED0.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5800 -
C:\Users\Admin\AppData\Local\Temp\5FAA.tmp"C:\Users\Admin\AppData\Local\Temp\5FAA.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\6027.tmp"C:\Users\Admin\AppData\Local\Temp\6027.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\60B4.tmp"C:\Users\Admin\AppData\Local\Temp\60B4.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\6141.tmp"C:\Users\Admin\AppData\Local\Temp\6141.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\61AE.tmp"C:\Users\Admin\AppData\Local\Temp\61AE.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\624A.tmp"C:\Users\Admin\AppData\Local\Temp\624A.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\62C7.tmp"C:\Users\Admin\AppData\Local\Temp\62C7.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\6354.tmp"C:\Users\Admin\AppData\Local\Temp\6354.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\63E0.tmp"C:\Users\Admin\AppData\Local\Temp\63E0.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\645D.tmp"C:\Users\Admin\AppData\Local\Temp\645D.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\64FA.tmp"C:\Users\Admin\AppData\Local\Temp\64FA.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\6586.tmp"C:\Users\Admin\AppData\Local\Temp\6586.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\6623.tmp"C:\Users\Admin\AppData\Local\Temp\6623.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\675B.tmp"C:\Users\Admin\AppData\Local\Temp\675B.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\67E8.tmp"C:\Users\Admin\AppData\Local\Temp\67E8.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\6865.tmp"C:\Users\Admin\AppData\Local\Temp\6865.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\68F1.tmp"C:\Users\Admin\AppData\Local\Temp\68F1.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\697E.tmp"C:\Users\Admin\AppData\Local\Temp\697E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\6A0B.tmp"C:\Users\Admin\AppData\Local\Temp\6A0B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\6AB6.tmp"C:\Users\Admin\AppData\Local\Temp\6AB6.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\6B33.tmp"C:\Users\Admin\AppData\Local\Temp\6B33.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\6BB0.tmp"C:\Users\Admin\AppData\Local\Temp\6BB0.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\6C1E.tmp"C:\Users\Admin\AppData\Local\Temp\6C1E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"65⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\6D37.tmp"C:\Users\Admin\AppData\Local\Temp\6D37.tmp"66⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\6DC4.tmp"C:\Users\Admin\AppData\Local\Temp\6DC4.tmp"67⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\6E31.tmp"C:\Users\Admin\AppData\Local\Temp\6E31.tmp"68⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\6EAE.tmp"C:\Users\Admin\AppData\Local\Temp\6EAE.tmp"69⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"70⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\6FC7.tmp"C:\Users\Admin\AppData\Local\Temp\6FC7.tmp"71⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\7044.tmp"C:\Users\Admin\AppData\Local\Temp\7044.tmp"72⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\70D1.tmp"C:\Users\Admin\AppData\Local\Temp\70D1.tmp"73⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\715E.tmp"C:\Users\Admin\AppData\Local\Temp\715E.tmp"74⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\71EA.tmp"C:\Users\Admin\AppData\Local\Temp\71EA.tmp"75⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\7277.tmp"C:\Users\Admin\AppData\Local\Temp\7277.tmp"76⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\72F4.tmp"C:\Users\Admin\AppData\Local\Temp\72F4.tmp"77⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\7390.tmp"C:\Users\Admin\AppData\Local\Temp\7390.tmp"78⤵PID:5524
-
C:\Users\Admin\AppData\Local\Temp\741D.tmp"C:\Users\Admin\AppData\Local\Temp\741D.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\749A.tmp"C:\Users\Admin\AppData\Local\Temp\749A.tmp"80⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\7526.tmp"C:\Users\Admin\AppData\Local\Temp\7526.tmp"81⤵PID:5512
-
C:\Users\Admin\AppData\Local\Temp\75B3.tmp"C:\Users\Admin\AppData\Local\Temp\75B3.tmp"82⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\7640.tmp"C:\Users\Admin\AppData\Local\Temp\7640.tmp"83⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\76BD.tmp"C:\Users\Admin\AppData\Local\Temp\76BD.tmp"84⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\7749.tmp"C:\Users\Admin\AppData\Local\Temp\7749.tmp"85⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\77D6.tmp"C:\Users\Admin\AppData\Local\Temp\77D6.tmp"86⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\7853.tmp"C:\Users\Admin\AppData\Local\Temp\7853.tmp"87⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\78D0.tmp"C:\Users\Admin\AppData\Local\Temp\78D0.tmp"88⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\794D.tmp"C:\Users\Admin\AppData\Local\Temp\794D.tmp"89⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\79CA.tmp"C:\Users\Admin\AppData\Local\Temp\79CA.tmp"90⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\7A56.tmp"C:\Users\Admin\AppData\Local\Temp\7A56.tmp"91⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\7AD3.tmp"C:\Users\Admin\AppData\Local\Temp\7AD3.tmp"92⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\7B41.tmp"C:\Users\Admin\AppData\Local\Temp\7B41.tmp"93⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\7BAE.tmp"C:\Users\Admin\AppData\Local\Temp\7BAE.tmp"94⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\7C2B.tmp"C:\Users\Admin\AppData\Local\Temp\7C2B.tmp"95⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"96⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\7D25.tmp"C:\Users\Admin\AppData\Local\Temp\7D25.tmp"97⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"98⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"99⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\7EBB.tmp"C:\Users\Admin\AppData\Local\Temp\7EBB.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\7F38.tmp"C:\Users\Admin\AppData\Local\Temp\7F38.tmp"101⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\7FB5.tmp"C:\Users\Admin\AppData\Local\Temp\7FB5.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\8052.tmp"C:\Users\Admin\AppData\Local\Temp\8052.tmp"103⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\80CF.tmp"C:\Users\Admin\AppData\Local\Temp\80CF.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\818A.tmp"C:\Users\Admin\AppData\Local\Temp\818A.tmp"105⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\81F8.tmp"C:\Users\Admin\AppData\Local\Temp\81F8.tmp"106⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\8275.tmp"C:\Users\Admin\AppData\Local\Temp\8275.tmp"107⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\8320.tmp"C:\Users\Admin\AppData\Local\Temp\8320.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\83EC.tmp"C:\Users\Admin\AppData\Local\Temp\83EC.tmp"109⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\8469.tmp"C:\Users\Admin\AppData\Local\Temp\8469.tmp"110⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\84F5.tmp"C:\Users\Admin\AppData\Local\Temp\84F5.tmp"111⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\8582.tmp"C:\Users\Admin\AppData\Local\Temp\8582.tmp"112⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\861E.tmp"C:\Users\Admin\AppData\Local\Temp\861E.tmp"113⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\86AB.tmp"C:\Users\Admin\AppData\Local\Temp\86AB.tmp"114⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\8766.tmp"C:\Users\Admin\AppData\Local\Temp\8766.tmp"115⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\87E3.tmp"C:\Users\Admin\AppData\Local\Temp\87E3.tmp"116⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\8860.tmp"C:\Users\Admin\AppData\Local\Temp\8860.tmp"117⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\88DD.tmp"C:\Users\Admin\AppData\Local\Temp\88DD.tmp"118⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\895A.tmp"C:\Users\Admin\AppData\Local\Temp\895A.tmp"119⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\89D7.tmp"C:\Users\Admin\AppData\Local\Temp\89D7.tmp"120⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\8A54.tmp"C:\Users\Admin\AppData\Local\Temp\8A54.tmp"121⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"122⤵PID:4200
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-