Analysis
- max time kernel
129s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 02:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_9e8a445d6529997707d783e0bd401bbf_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_9e8a445d6529997707d783e0bd401bbf_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_9e8a445d6529997707d783e0bd401bbf_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260802-da2w3ssgja
- SHA256 d09a7ccef4b6dbaab1b5a3df0c343d032302c8c351e6a8ae09324c00df7a0d3d
- MD5 9e8a445d6529997707d783e0bd401bbf
- SHA1 ae9cbf42eef1195ea999ee67542d714fccc8b97f
- SHA512 54ba670dd9f3885be29111b3ebb993322b9ffb02a1b9577062f966e2adff348be0687ed466670f4243193571079d52cff6739083e3b4e91efb0363c3c7b66693
- SSDEEP 6144:qorf3lPvovsgZnqG2C7mOTeiL9DUiffKRGZEb5oPUe7I6VAz6U63FzGdNR/S26f5:HU5rCOTeiJDE3e7I16X3lyADlpO8NZ
- TLSH T1AEB4E122B989C032E59211304EE6EBB2293ABD755B2564C73B84777E6EB03D19778307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6012 2D8E.tmp 3108 2E2A.tmp 1416 2EF6.tmp 4460 2FB1.tmp 4560 303E.tmp 4216 30EA.tmp 1232 3157.tmp 4364 3232.tmp 2108 32CE.tmp 832 337A.tmp 1200 34A3.tmp 4988 356E.tmp 5996 360A.tmp 1316 3697.tmp 4944 3743.tmp 2452 381D.tmp 3084 3917.tmp 2580 39C3.tmp 5540 3A6F.tmp 1972 3B59.tmp 244 3BF6.tmp 3672 3CF0.tmp 3980 3DAB.tmp 5684 3E67.tmp 4300 3F03.tmp 1364 3F9F.tmp 4516 405B.tmp 5392 4145.tmp 2928 41E1.tmp 2696 429D.tmp 3324 4368.tmp 5596 43F5.tmp 4852 4491.tmp 1672 451D.tmp 4788 459A.tmp 5104 4627.tmp 4220 46C3.tmp 2860 4731.tmp 2072 47CD.tmp 3904 483A.tmp 2752 4915.tmp 5884 49B1.tmp 3880 4A4E.tmp 3144 4AEA.tmp 1436 4B67.tmp 2532 4BE4.tmp 4532 4C51.tmp 5592 4CCE.tmp 1400 4D5B.tmp 2548 4DF7.tmp 624 4E55.tmp 2380 4ED2.tmp 2712 4F7E.tmp 5512 4FFB.tmp 1736 5078.tmp 4296 50D5.tmp 3172 5162.tmp 4760 521E.tmp 1440 52AA.tmp 4328 5327.tmp 5900 53A4.tmp 3708 5440.tmp 6016 54EC.tmp 2760 555A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 354A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 929C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F742.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 151F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 610D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ADF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A79B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 178C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 647D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F40B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 835A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9878.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B799.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 408.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D69F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A394.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 499D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 216F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 759F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C96C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4B6.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3800 wrote to memory of 6012 3800 2026-08-02_9e8a445d6529997707d783e0bd401bbf_elex_mafia_stealc_tofsee.exe 89 PID 6012 wrote to memory of 3108 6012 2D8E.tmp 90 PID 3108 wrote to memory of 1416 3108 2E2A.tmp 91 PID 1416 wrote to memory of 4460 1416 2EF6.tmp 92 PID 4460 wrote to memory of 4560 4460 2FB1.tmp 93 PID 4560 wrote to memory of 4216 4560 303E.tmp 94 PID 4216 wrote to memory of 1232 4216 30EA.tmp 95 PID 1232 wrote to memory of 4364 1232 3157.tmp 96 PID 4364 wrote to memory of 2108 4364 3232.tmp 97 PID 2108 wrote to memory of 832 2108 32CE.tmp 98 PID 832 wrote to memory of 1200 832 337A.tmp 99 PID 1200 wrote to memory of 4988 1200 34A3.tmp 100 PID 4988 wrote to memory of 5996 4988 356E.tmp 101 PID 5996 wrote to memory of 1316 5996 360A.tmp 102 PID 1316 wrote to memory of 4944 1316 3697.tmp 103 PID 4944 wrote to memory of 2452 4944 3743.tmp 104 PID 2452 wrote to memory of 3084 2452 381D.tmp 105 PID 3084 wrote to memory of 2580 3084 3917.tmp 106 PID 2580 wrote to memory of 5540 2580 39C3.tmp 107 PID 5540 wrote to memory of 1972 5540 3A6F.tmp 108 PID 1972 wrote to memory of 244 1972 3B59.tmp 109 PID 244 wrote to memory of 3672 244 3BF6.tmp 110 PID 3672 wrote to memory of 3980 3672 3CF0.tmp 111 PID 3980 wrote to memory of 5684 3980 3DAB.tmp 112 PID 5684 wrote to memory of 4300 5684 3E67.tmp 113 PID 4300 wrote to memory of 1364 4300 3F03.tmp 114 PID 1364 wrote to memory of 4516 1364 3F9F.tmp 115 PID 4516 wrote to memory of 5392 4516 405B.tmp 116 PID 5392 wrote to memory of 2928 5392 4145.tmp 117 PID 2928 wrote to memory of 2696 2928 41E1.tmp 118 PID 2696 wrote to memory of 3324 2696 429D.tmp 119 PID 3324 wrote to memory of 5596 3324 4368.tmp 120 PID 5596 wrote to memory of 4852 5596 43F5.tmp 121 PID 4852 wrote to memory of 1672 4852 4491.tmp 122 PID 1672 wrote to memory of 4788 1672 451D.tmp 123 PID 4788 wrote to memory of 5104 4788 459A.tmp 124 PID 5104 wrote to memory of 4220 5104 4627.tmp 125 PID 4220 wrote to memory of 2860 4220 46C3.tmp 126 PID 2860 wrote to memory of 2072 2860 4731.tmp 127 PID 2072 wrote to memory of 3904 2072 47CD.tmp 128 PID 3904 wrote to memory of 2752 3904 483A.tmp 129 PID 2752 wrote to memory of 5884 2752 4915.tmp 130 PID 5884 wrote to memory of 3880 5884 49B1.tmp 131 PID 3880 wrote to memory of 3144 3880 4A4E.tmp 132 PID 3144 wrote to memory of 1436 3144 4AEA.tmp 133 PID 1436 wrote to memory of 2532 1436 4B67.tmp 134 PID 2532 wrote to memory of 4532 2532 4BE4.tmp 135 PID 4532 wrote to memory of 5592 4532 4C51.tmp 136 PID 5592 wrote to memory of 1400 5592 4CCE.tmp 137 PID 1400 wrote to memory of 2548 1400 4D5B.tmp 138 PID 2548 wrote to memory of 624 2548 4DF7.tmp 139 PID 624 wrote to memory of 2380 624 4E55.tmp 140 PID 2380 wrote to memory of 2712 2380 4ED2.tmp 141 PID 2712 wrote to memory of 5512 2712 4F7E.tmp 142 PID 5512 wrote to memory of 1736 5512 4FFB.tmp 143 PID 1736 wrote to memory of 4296 1736 5078.tmp 144 PID 4296 wrote to memory of 3172 4296 50D5.tmp 145 PID 3172 wrote to memory of 4760 3172 5162.tmp 146 PID 4760 wrote to memory of 1440 4760 521E.tmp 147 PID 1440 wrote to memory of 4328 1440 52AA.tmp 148 PID 4328 wrote to memory of 5900 4328 5327.tmp 149 PID 5900 wrote to memory of 3708 5900 53A4.tmp 150 PID 3708 wrote to memory of 6016 3708 5440.tmp 151 PID 6016 wrote to memory of 2760 6016 54EC.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_9e8a445d6529997707d783e0bd401bbf_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_9e8a445d6529997707d783e0bd401bbf_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\2D8E.tmp"C:\Users\Admin\AppData\Local\Temp\2D8E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"C:\Users\Admin\AppData\Local\Temp\2E2A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\2EF6.tmp"C:\Users\Admin\AppData\Local\Temp\2EF6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"C:\Users\Admin\AppData\Local\Temp\2FB1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\303E.tmp"C:\Users\Admin\AppData\Local\Temp\303E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\30EA.tmp"C:\Users\Admin\AppData\Local\Temp\30EA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\3157.tmp"C:\Users\Admin\AppData\Local\Temp\3157.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\3232.tmp"C:\Users\Admin\AppData\Local\Temp\3232.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\32CE.tmp"C:\Users\Admin\AppData\Local\Temp\32CE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\337A.tmp"C:\Users\Admin\AppData\Local\Temp\337A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\34A3.tmp"C:\Users\Admin\AppData\Local\Temp\34A3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\356E.tmp"C:\Users\Admin\AppData\Local\Temp\356E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\360A.tmp"C:\Users\Admin\AppData\Local\Temp\360A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\3697.tmp"C:\Users\Admin\AppData\Local\Temp\3697.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\3743.tmp"C:\Users\Admin\AppData\Local\Temp\3743.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\381D.tmp"C:\Users\Admin\AppData\Local\Temp\381D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\3917.tmp"C:\Users\Admin\AppData\Local\Temp\3917.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\39C3.tmp"C:\Users\Admin\AppData\Local\Temp\39C3.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\3B59.tmp"C:\Users\Admin\AppData\Local\Temp\3B59.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3BF6.tmp"C:\Users\Admin\AppData\Local\Temp\3BF6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\3CF0.tmp"C:\Users\Admin\AppData\Local\Temp\3CF0.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\3DAB.tmp"C:\Users\Admin\AppData\Local\Temp\3DAB.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\3E67.tmp"C:\Users\Admin\AppData\Local\Temp\3E67.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\405B.tmp"C:\Users\Admin\AppData\Local\Temp\405B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\4145.tmp"C:\Users\Admin\AppData\Local\Temp\4145.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\41E1.tmp"C:\Users\Admin\AppData\Local\Temp\41E1.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\429D.tmp"C:\Users\Admin\AppData\Local\Temp\429D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\4368.tmp"C:\Users\Admin\AppData\Local\Temp\4368.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\43F5.tmp"C:\Users\Admin\AppData\Local\Temp\43F5.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\4491.tmp"C:\Users\Admin\AppData\Local\Temp\4491.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\451D.tmp"C:\Users\Admin\AppData\Local\Temp\451D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\459A.tmp"C:\Users\Admin\AppData\Local\Temp\459A.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\4627.tmp"C:\Users\Admin\AppData\Local\Temp\4627.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\46C3.tmp"C:\Users\Admin\AppData\Local\Temp\46C3.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\4731.tmp"C:\Users\Admin\AppData\Local\Temp\4731.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\47CD.tmp"C:\Users\Admin\AppData\Local\Temp\47CD.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\483A.tmp"C:\Users\Admin\AppData\Local\Temp\483A.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\4915.tmp"C:\Users\Admin\AppData\Local\Temp\4915.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\49B1.tmp"C:\Users\Admin\AppData\Local\Temp\49B1.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\4A4E.tmp"C:\Users\Admin\AppData\Local\Temp\4A4E.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\4AEA.tmp"C:\Users\Admin\AppData\Local\Temp\4AEA.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\4B67.tmp"C:\Users\Admin\AppData\Local\Temp\4B67.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\4BE4.tmp"C:\Users\Admin\AppData\Local\Temp\4BE4.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\4C51.tmp"C:\Users\Admin\AppData\Local\Temp\4C51.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\4CCE.tmp"C:\Users\Admin\AppData\Local\Temp\4CCE.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\4D5B.tmp"C:\Users\Admin\AppData\Local\Temp\4D5B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\4DF7.tmp"C:\Users\Admin\AppData\Local\Temp\4DF7.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\4E55.tmp"C:\Users\Admin\AppData\Local\Temp\4E55.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\4ED2.tmp"C:\Users\Admin\AppData\Local\Temp\4ED2.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\4FFB.tmp"C:\Users\Admin\AppData\Local\Temp\4FFB.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\5078.tmp"C:\Users\Admin\AppData\Local\Temp\5078.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\50D5.tmp"C:\Users\Admin\AppData\Local\Temp\50D5.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\5162.tmp"C:\Users\Admin\AppData\Local\Temp\5162.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\521E.tmp"C:\Users\Admin\AppData\Local\Temp\521E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\52AA.tmp"C:\Users\Admin\AppData\Local\Temp\52AA.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\5327.tmp"C:\Users\Admin\AppData\Local\Temp\5327.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\53A4.tmp"C:\Users\Admin\AppData\Local\Temp\53A4.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\5440.tmp"C:\Users\Admin\AppData\Local\Temp\5440.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\54EC.tmp"C:\Users\Admin\AppData\Local\Temp\54EC.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\555A.tmp"C:\Users\Admin\AppData\Local\Temp\555A.tmp"65⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\55E6.tmp"C:\Users\Admin\AppData\Local\Temp\55E6.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\5673.tmp"C:\Users\Admin\AppData\Local\Temp\5673.tmp"67⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\570F.tmp"C:\Users\Admin\AppData\Local\Temp\570F.tmp"68⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\579C.tmp"C:\Users\Admin\AppData\Local\Temp\579C.tmp"69⤵PID:5312
-
C:\Users\Admin\AppData\Local\Temp\5819.tmp"C:\Users\Admin\AppData\Local\Temp\5819.tmp"70⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\58C5.tmp"C:\Users\Admin\AppData\Local\Temp\58C5.tmp"71⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\5951.tmp"C:\Users\Admin\AppData\Local\Temp\5951.tmp"72⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\59EE.tmp"C:\Users\Admin\AppData\Local\Temp\59EE.tmp"73⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\5A99.tmp"C:\Users\Admin\AppData\Local\Temp\5A99.tmp"74⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\5B16.tmp"C:\Users\Admin\AppData\Local\Temp\5B16.tmp"75⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\5B93.tmp"C:\Users\Admin\AppData\Local\Temp\5B93.tmp"76⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\5C20.tmp"C:\Users\Admin\AppData\Local\Temp\5C20.tmp"77⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\5C8D.tmp"C:\Users\Admin\AppData\Local\Temp\5C8D.tmp"78⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\5D1A.tmp"C:\Users\Admin\AppData\Local\Temp\5D1A.tmp"79⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\5DA7.tmp"C:\Users\Admin\AppData\Local\Temp\5DA7.tmp"80⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\5E24.tmp"C:\Users\Admin\AppData\Local\Temp\5E24.tmp"81⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\5EA1.tmp"C:\Users\Admin\AppData\Local\Temp\5EA1.tmp"82⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"83⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\5FBA.tmp"C:\Users\Admin\AppData\Local\Temp\5FBA.tmp"84⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\6037.tmp"C:\Users\Admin\AppData\Local\Temp\6037.tmp"85⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\60A4.tmp"C:\Users\Admin\AppData\Local\Temp\60A4.tmp"86⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\6141.tmp"C:\Users\Admin\AppData\Local\Temp\6141.tmp"87⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\61BE.tmp"C:\Users\Admin\AppData\Local\Temp\61BE.tmp"88⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\622B.tmp"C:\Users\Admin\AppData\Local\Temp\622B.tmp"89⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\62D7.tmp"C:\Users\Admin\AppData\Local\Temp\62D7.tmp"90⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\6363.tmp"C:\Users\Admin\AppData\Local\Temp\6363.tmp"91⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\63E0.tmp"C:\Users\Admin\AppData\Local\Temp\63E0.tmp"92⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\647D.tmp"C:\Users\Admin\AppData\Local\Temp\647D.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:248 -
C:\Users\Admin\AppData\Local\Temp\64FA.tmp"C:\Users\Admin\AppData\Local\Temp\64FA.tmp"94⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\6567.tmp"C:\Users\Admin\AppData\Local\Temp\6567.tmp"95⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\65E4.tmp"C:\Users\Admin\AppData\Local\Temp\65E4.tmp"96⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"97⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\66CE.tmp"C:\Users\Admin\AppData\Local\Temp\66CE.tmp"98⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\674B.tmp"C:\Users\Admin\AppData\Local\Temp\674B.tmp"99⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\67D8.tmp"C:\Users\Admin\AppData\Local\Temp\67D8.tmp"100⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\6874.tmp"C:\Users\Admin\AppData\Local\Temp\6874.tmp"101⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\68F1.tmp"C:\Users\Admin\AppData\Local\Temp\68F1.tmp"102⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\698E.tmp"C:\Users\Admin\AppData\Local\Temp\698E.tmp"103⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\6A2A.tmp"C:\Users\Admin\AppData\Local\Temp\6A2A.tmp"104⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\6AC6.tmp"C:\Users\Admin\AppData\Local\Temp\6AC6.tmp"105⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\6B53.tmp"C:\Users\Admin\AppData\Local\Temp\6B53.tmp"106⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\6BDF.tmp"C:\Users\Admin\AppData\Local\Temp\6BDF.tmp"107⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\6C5C.tmp"C:\Users\Admin\AppData\Local\Temp\6C5C.tmp"108⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\6CE9.tmp"C:\Users\Admin\AppData\Local\Temp\6CE9.tmp"109⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\6D76.tmp"C:\Users\Admin\AppData\Local\Temp\6D76.tmp"110⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"111⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"112⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\6F0C.tmp"C:\Users\Admin\AppData\Local\Temp\6F0C.tmp"113⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\6F89.tmp"C:\Users\Admin\AppData\Local\Temp\6F89.tmp"114⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\7006.tmp"C:\Users\Admin\AppData\Local\Temp\7006.tmp"115⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\7073.tmp"C:\Users\Admin\AppData\Local\Temp\7073.tmp"116⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\7100.tmp"C:\Users\Admin\AppData\Local\Temp\7100.tmp"117⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\717D.tmp"C:\Users\Admin\AppData\Local\Temp\717D.tmp"118⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\7219.tmp"C:\Users\Admin\AppData\Local\Temp\7219.tmp"119⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\72A6.tmp"C:\Users\Admin\AppData\Local\Temp\72A6.tmp"120⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\7323.tmp"C:\Users\Admin\AppData\Local\Temp\7323.tmp"121⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\73AF.tmp"C:\Users\Admin\AppData\Local\Temp\73AF.tmp"122⤵PID:2864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-