Analysis
- max time kernel
116s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_e081c7b4608ce86c53d7c7891ea85345_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_e081c7b4608ce86c53d7c7891ea85345_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-01_e081c7b4608ce86c53d7c7891ea85345_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260802-ee7tkacf89
- SHA256 db33baf49716223e3c39fee8479360adb341ea073db8bb5c77b654e580fdc343
- MD5 e081c7b4608ce86c53d7c7891ea85345
- SHA1 83377acb06efe62850c85011945d18320222dac5
- SHA512 5a67acb6d074449019c93a8966217cf58619612383ff43ead6952f99c2734e8c3014dae26420a6212e49230b9fe7c53afb2b2b5d4711f71fbeac88bfd1e59b1b
- SSDEEP 12288:wU5rCOTeiD5qDiSMxD4CvWGU6xz/kbNZ+3/v+I9hUG2VA:wUQOJD5+iSMxD4Cvw6x4NGEA
- TLSH T1ADE4D02177D88532E5F7037859B5E6614D7EBD32AB22D6CF2F8015AE0A71BD08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3664 264B.tmp 4236 2706.tmp 3408 2793.tmp 4488 2929.tmp 4332 2AB0.tmp 4952 2B6B.tmp 4300 2BF8.tmp 696 2CA4.tmp 4760 2E1B.tmp 5548 2EF6.tmp 5108 2FA1.tmp 2808 302E.tmp 4964 30F9.tmp 1004 31E4.tmp 5412 32AF.tmp 356 3389.tmp 4888 3474.tmp 3792 359D.tmp 3164 3677.tmp 1284 37A0.tmp 4836 384C.tmp 1844 38BA.tmp 5824 3927.tmp 2064 39C3.tmp 5860 3AAE.tmp 2256 3BA8.tmp 2112 3CB1.tmp 3880 3DAB.tmp 5032 3E76.tmp 6064 3F70.tmp 1704 405B.tmp 472 4145.tmp 1240 423F.tmp 4828 42BC.tmp 5988 4339.tmp 1220 43C6.tmp 1140 4491.tmp 2972 454C.tmp 5648 45D9.tmp 908 4685.tmp 3472 4731.tmp 5096 47FC.tmp 4968 48B7.tmp 5100 4934.tmp 2920 49C1.tmp 2036 4A6D.tmp 5312 4B57.tmp 4120 4BF3.tmp 4280 4C80.tmp 4624 4CFD.tmp 4156 4D99.tmp 5048 4E36.tmp 4792 4EB3.tmp 5216 4F30.tmp 4264 4F9D.tmp 3236 500A.tmp 1424 5087.tmp 2932 5114.tmp 6032 5191.tmp 5052 521E.tmp 3736 529B.tmp 5084 5318.tmp 4356 5385.tmp 944 5402.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E323.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F274.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 205A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9409.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5313.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C14E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A104.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A07C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A195.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4339.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F10D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7778.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8514.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ED8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E536.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 405B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5087.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B06A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6449.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 766A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 183C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B41F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F17A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A615.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F870.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 982F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7526.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A251.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B423.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB19.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2544 wrote to memory of 3664 2544 2026-08-01_e081c7b4608ce86c53d7c7891ea85345_elex_mafia_stealc_tofsee.exe 89 PID 3664 wrote to memory of 4236 3664 264B.tmp 90 PID 4236 wrote to memory of 3408 4236 2706.tmp 91 PID 3408 wrote to memory of 4488 3408 2793.tmp 92 PID 4488 wrote to memory of 4332 4488 2929.tmp 93 PID 4332 wrote to memory of 4952 4332 2AB0.tmp 94 PID 4952 wrote to memory of 4300 4952 2B6B.tmp 95 PID 4300 wrote to memory of 696 4300 2BF8.tmp 96 PID 696 wrote to memory of 4760 696 2CA4.tmp 97 PID 4760 wrote to memory of 5548 4760 2E1B.tmp 98 PID 5548 wrote to memory of 5108 5548 2EF6.tmp 99 PID 5108 wrote to memory of 2808 5108 2FA1.tmp 100 PID 2808 wrote to memory of 4964 2808 302E.tmp 101 PID 4964 wrote to memory of 1004 4964 30F9.tmp 102 PID 1004 wrote to memory of 5412 1004 31E4.tmp 103 PID 5412 wrote to memory of 356 5412 32AF.tmp 104 PID 356 wrote to memory of 4888 356 3389.tmp 105 PID 4888 wrote to memory of 3792 4888 3474.tmp 106 PID 3792 wrote to memory of 3164 3792 359D.tmp 107 PID 3164 wrote to memory of 1284 3164 3677.tmp 108 PID 1284 wrote to memory of 4836 1284 37A0.tmp 109 PID 4836 wrote to memory of 1844 4836 384C.tmp 110 PID 1844 wrote to memory of 5824 1844 38BA.tmp 111 PID 5824 wrote to memory of 2064 5824 3927.tmp 112 PID 2064 wrote to memory of 5860 2064 39C3.tmp 113 PID 5860 wrote to memory of 2256 5860 3AAE.tmp 114 PID 2256 wrote to memory of 2112 2256 3BA8.tmp 115 PID 2112 wrote to memory of 3880 2112 3CB1.tmp 116 PID 3880 wrote to memory of 5032 3880 3DAB.tmp 117 PID 5032 wrote to memory of 6064 5032 3E76.tmp 118 PID 6064 wrote to memory of 1704 6064 3F70.tmp 119 PID 1704 wrote to memory of 472 1704 405B.tmp 120 PID 472 wrote to memory of 1240 472 4145.tmp 121 PID 1240 wrote to memory of 4828 1240 423F.tmp 122 PID 4828 wrote to memory of 5988 4828 42BC.tmp 123 PID 5988 wrote to memory of 1220 5988 4339.tmp 124 PID 1220 wrote to memory of 1140 1220 43C6.tmp 125 PID 1140 wrote to memory of 2972 1140 4491.tmp 126 PID 2972 wrote to memory of 5648 2972 454C.tmp 127 PID 5648 wrote to memory of 908 5648 45D9.tmp 128 PID 908 wrote to memory of 3472 908 4685.tmp 129 PID 3472 wrote to memory of 5096 3472 4731.tmp 130 PID 5096 wrote to memory of 4968 5096 47FC.tmp 131 PID 4968 wrote to memory of 5100 4968 48B7.tmp 132 PID 5100 wrote to memory of 2920 5100 4934.tmp 133 PID 2920 wrote to memory of 2036 2920 49C1.tmp 134 PID 2036 wrote to memory of 5312 2036 4A6D.tmp 135 PID 5312 wrote to memory of 4120 5312 4B57.tmp 136 PID 4120 wrote to memory of 4280 4120 4BF3.tmp 137 PID 4280 wrote to memory of 4624 4280 4C80.tmp 138 PID 4624 wrote to memory of 4156 4624 4CFD.tmp 139 PID 4156 wrote to memory of 5048 4156 4D99.tmp 140 PID 5048 wrote to memory of 4792 5048 4E36.tmp 141 PID 4792 wrote to memory of 5216 4792 4EB3.tmp 142 PID 5216 wrote to memory of 4264 5216 4F30.tmp 143 PID 4264 wrote to memory of 3236 4264 4F9D.tmp 144 PID 3236 wrote to memory of 1424 3236 500A.tmp 145 PID 1424 wrote to memory of 2932 1424 5087.tmp 146 PID 2932 wrote to memory of 6032 2932 5114.tmp 147 PID 6032 wrote to memory of 5052 6032 5191.tmp 148 PID 5052 wrote to memory of 3736 5052 521E.tmp 149 PID 3736 wrote to memory of 5084 3736 529B.tmp 150 PID 5084 wrote to memory of 4356 5084 5318.tmp 151 PID 4356 wrote to memory of 944 4356 5385.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_e081c7b4608ce86c53d7c7891ea85345_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_e081c7b4608ce86c53d7c7891ea85345_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\264B.tmp"C:\Users\Admin\AppData\Local\Temp\264B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\2706.tmp"C:\Users\Admin\AppData\Local\Temp\2706.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\2793.tmp"C:\Users\Admin\AppData\Local\Temp\2793.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\2929.tmp"C:\Users\Admin\AppData\Local\Temp\2929.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\2AB0.tmp"C:\Users\Admin\AppData\Local\Temp\2AB0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\2B6B.tmp"C:\Users\Admin\AppData\Local\Temp\2B6B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\2BF8.tmp"C:\Users\Admin\AppData\Local\Temp\2BF8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\2CA4.tmp"C:\Users\Admin\AppData\Local\Temp\2CA4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\2EF6.tmp"C:\Users\Admin\AppData\Local\Temp\2EF6.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\302E.tmp"C:\Users\Admin\AppData\Local\Temp\302E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\30F9.tmp"C:\Users\Admin\AppData\Local\Temp\30F9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\31E4.tmp"C:\Users\Admin\AppData\Local\Temp\31E4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\32AF.tmp"C:\Users\Admin\AppData\Local\Temp\32AF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\3389.tmp"C:\Users\Admin\AppData\Local\Temp\3389.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:356 -
C:\Users\Admin\AppData\Local\Temp\3474.tmp"C:\Users\Admin\AppData\Local\Temp\3474.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\359D.tmp"C:\Users\Admin\AppData\Local\Temp\359D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\3677.tmp"C:\Users\Admin\AppData\Local\Temp\3677.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\37A0.tmp"C:\Users\Admin\AppData\Local\Temp\37A0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\384C.tmp"C:\Users\Admin\AppData\Local\Temp\384C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\38BA.tmp"C:\Users\Admin\AppData\Local\Temp\38BA.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\3927.tmp"C:\Users\Admin\AppData\Local\Temp\3927.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\39C3.tmp"C:\Users\Admin\AppData\Local\Temp\39C3.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\3BA8.tmp"C:\Users\Admin\AppData\Local\Temp\3BA8.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\3CB1.tmp"C:\Users\Admin\AppData\Local\Temp\3CB1.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\3DAB.tmp"C:\Users\Admin\AppData\Local\Temp\3DAB.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\3E76.tmp"C:\Users\Admin\AppData\Local\Temp\3E76.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\405B.tmp"C:\Users\Admin\AppData\Local\Temp\405B.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\4145.tmp"C:\Users\Admin\AppData\Local\Temp\4145.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\423F.tmp"C:\Users\Admin\AppData\Local\Temp\423F.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\42BC.tmp"C:\Users\Admin\AppData\Local\Temp\42BC.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\4339.tmp"C:\Users\Admin\AppData\Local\Temp\4339.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\43C6.tmp"C:\Users\Admin\AppData\Local\Temp\43C6.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\4491.tmp"C:\Users\Admin\AppData\Local\Temp\4491.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\454C.tmp"C:\Users\Admin\AppData\Local\Temp\454C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\45D9.tmp"C:\Users\Admin\AppData\Local\Temp\45D9.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\4685.tmp"C:\Users\Admin\AppData\Local\Temp\4685.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\4731.tmp"C:\Users\Admin\AppData\Local\Temp\4731.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\47FC.tmp"C:\Users\Admin\AppData\Local\Temp\47FC.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\48B7.tmp"C:\Users\Admin\AppData\Local\Temp\48B7.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\4934.tmp"C:\Users\Admin\AppData\Local\Temp\4934.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\49C1.tmp"C:\Users\Admin\AppData\Local\Temp\49C1.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\4B57.tmp"C:\Users\Admin\AppData\Local\Temp\4B57.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\4BF3.tmp"C:\Users\Admin\AppData\Local\Temp\4BF3.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\4C80.tmp"C:\Users\Admin\AppData\Local\Temp\4C80.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\4D99.tmp"C:\Users\Admin\AppData\Local\Temp\4D99.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\4E36.tmp"C:\Users\Admin\AppData\Local\Temp\4E36.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\4EB3.tmp"C:\Users\Admin\AppData\Local\Temp\4EB3.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\4F30.tmp"C:\Users\Admin\AppData\Local\Temp\4F30.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\500A.tmp"C:\Users\Admin\AppData\Local\Temp\500A.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\5087.tmp"C:\Users\Admin\AppData\Local\Temp\5087.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\5114.tmp"C:\Users\Admin\AppData\Local\Temp\5114.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\5191.tmp"C:\Users\Admin\AppData\Local\Temp\5191.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\521E.tmp"C:\Users\Admin\AppData\Local\Temp\521E.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\529B.tmp"C:\Users\Admin\AppData\Local\Temp\529B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\5318.tmp"C:\Users\Admin\AppData\Local\Temp\5318.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\5385.tmp"C:\Users\Admin\AppData\Local\Temp\5385.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\5402.tmp"C:\Users\Admin\AppData\Local\Temp\5402.tmp"65⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\546F.tmp"C:\Users\Admin\AppData\Local\Temp\546F.tmp"66⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\54EC.tmp"C:\Users\Admin\AppData\Local\Temp\54EC.tmp"67⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\555A.tmp"C:\Users\Admin\AppData\Local\Temp\555A.tmp"68⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\55C7.tmp"C:\Users\Admin\AppData\Local\Temp\55C7.tmp"69⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\5654.tmp"C:\Users\Admin\AppData\Local\Temp\5654.tmp"70⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\56D1.tmp"C:\Users\Admin\AppData\Local\Temp\56D1.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\576D.tmp"C:\Users\Admin\AppData\Local\Temp\576D.tmp"72⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\57DA.tmp"C:\Users\Admin\AppData\Local\Temp\57DA.tmp"73⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\5867.tmp"C:\Users\Admin\AppData\Local\Temp\5867.tmp"74⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\58D4.tmp"C:\Users\Admin\AppData\Local\Temp\58D4.tmp"75⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\5961.tmp"C:\Users\Admin\AppData\Local\Temp\5961.tmp"76⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\59FD.tmp"C:\Users\Admin\AppData\Local\Temp\59FD.tmp"77⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\5A8A.tmp"C:\Users\Admin\AppData\Local\Temp\5A8A.tmp"78⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\5AF7.tmp"C:\Users\Admin\AppData\Local\Temp\5AF7.tmp"79⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\5B65.tmp"C:\Users\Admin\AppData\Local\Temp\5B65.tmp"80⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\5BF1.tmp"C:\Users\Admin\AppData\Local\Temp\5BF1.tmp"81⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\5C7E.tmp"C:\Users\Admin\AppData\Local\Temp\5C7E.tmp"82⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\5D0A.tmp"C:\Users\Admin\AppData\Local\Temp\5D0A.tmp"83⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\5D97.tmp"C:\Users\Admin\AppData\Local\Temp\5D97.tmp"84⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\5E24.tmp"C:\Users\Admin\AppData\Local\Temp\5E24.tmp"85⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\5E91.tmp"C:\Users\Admin\AppData\Local\Temp\5E91.tmp"86⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"87⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\5FCA.tmp"C:\Users\Admin\AppData\Local\Temp\5FCA.tmp"88⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\6047.tmp"C:\Users\Admin\AppData\Local\Temp\6047.tmp"89⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\60C4.tmp"C:\Users\Admin\AppData\Local\Temp\60C4.tmp"90⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\6150.tmp"C:\Users\Admin\AppData\Local\Temp\6150.tmp"91⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\61DD.tmp"C:\Users\Admin\AppData\Local\Temp\61DD.tmp"92⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\625A.tmp"C:\Users\Admin\AppData\Local\Temp\625A.tmp"93⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\62D7.tmp"C:\Users\Admin\AppData\Local\Temp\62D7.tmp"94⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\6363.tmp"C:\Users\Admin\AppData\Local\Temp\6363.tmp"95⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\63C1.tmp"C:\Users\Admin\AppData\Local\Temp\63C1.tmp"96⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\644E.tmp"C:\Users\Admin\AppData\Local\Temp\644E.tmp"97⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\64DA.tmp"C:\Users\Admin\AppData\Local\Temp\64DA.tmp"98⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\6557.tmp"C:\Users\Admin\AppData\Local\Temp\6557.tmp"99⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\65D4.tmp"C:\Users\Admin\AppData\Local\Temp\65D4.tmp"100⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\6671.tmp"C:\Users\Admin\AppData\Local\Temp\6671.tmp"101⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\66FD.tmp"C:\Users\Admin\AppData\Local\Temp\66FD.tmp"102⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\677A.tmp"C:\Users\Admin\AppData\Local\Temp\677A.tmp"103⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\6817.tmp"C:\Users\Admin\AppData\Local\Temp\6817.tmp"104⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\6894.tmp"C:\Users\Admin\AppData\Local\Temp\6894.tmp"105⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\6920.tmp"C:\Users\Admin\AppData\Local\Temp\6920.tmp"106⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\69AD.tmp"C:\Users\Admin\AppData\Local\Temp\69AD.tmp"107⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\6A49.tmp"C:\Users\Admin\AppData\Local\Temp\6A49.tmp"108⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\6AE5.tmp"C:\Users\Admin\AppData\Local\Temp\6AE5.tmp"109⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\6B62.tmp"C:\Users\Admin\AppData\Local\Temp\6B62.tmp"110⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\6BDF.tmp"C:\Users\Admin\AppData\Local\Temp\6BDF.tmp"111⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\6C5C.tmp"C:\Users\Admin\AppData\Local\Temp\6C5C.tmp"112⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\6CD9.tmp"C:\Users\Admin\AppData\Local\Temp\6CD9.tmp"113⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\6D56.tmp"C:\Users\Admin\AppData\Local\Temp\6D56.tmp"114⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\6DE3.tmp"C:\Users\Admin\AppData\Local\Temp\6DE3.tmp"115⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\6E7F.tmp"C:\Users\Admin\AppData\Local\Temp\6E7F.tmp"116⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\6F0C.tmp"C:\Users\Admin\AppData\Local\Temp\6F0C.tmp"117⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\6F98.tmp"C:\Users\Admin\AppData\Local\Temp\6F98.tmp"118⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\7025.tmp"C:\Users\Admin\AppData\Local\Temp\7025.tmp"119⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\70C1.tmp"C:\Users\Admin\AppData\Local\Temp\70C1.tmp"120⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\713E.tmp"C:\Users\Admin\AppData\Local\Temp\713E.tmp"121⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\71DB.tmp"C:\Users\Admin\AppData\Local\Temp\71DB.tmp"122⤵PID:1840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-