Analysis
- max time kernel
123s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_dfbdbc0fa9d0ccb98d79f7f9ab8e6845_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_dfbdbc0fa9d0ccb98d79f7f9ab8e6845_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-01_dfbdbc0fa9d0ccb98d79f7f9ab8e6845_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260802-efejeacf96
- SHA256 92eac5a94797197cc8ba28ad3b819e1c6e66a4411939bf1af4ffb0ad6557313c
- MD5 dfbdbc0fa9d0ccb98d79f7f9ab8e6845
- SHA1 8cf11ef73cb3571581098043c03c8372a1ffd95f
- SHA512 da84c11c7c7f49c1619e8cc01a39d674e212c61c06ded1e41bb9ec2351aa1f5bc7e8f9ccf801639bf0d610c8b8416b6342f1e8f93e2ce66d1bbb440f1000d2fe
- SSDEEP 12288:wU5rCOTeiDDIhqxNxfp4/nvgzu1iTrXh30E+L5ZNZ+3/v+I9hUG2VA:wUQOJDkhDPv2yiTrXhk7dZNGEA
- TLSH T14FE4D02173D88536E5F7037859B5E6644A7EFD369722D6DF2F8012AE09B1BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1864 4637.tmp 2592 46F2.tmp 3884 47EC.tmp 4740 4888.tmp 1056 48F6.tmp 1796 4AF9.tmp 4732 4C51.tmp 5320 4CCE.tmp 5616 4D5B.tmp 960 4E64.tmp 4316 4EE1.tmp 576 4FDB.tmp 5868 50B6.tmp 2224 5133.tmp 3788 51A1.tmp 3540 52F8.tmp 1948 53E3.tmp 3292 54CD.tmp 956 55B7.tmp 4604 5634.tmp 2680 56F0.tmp 2532 5828.tmp 4816 5903.tmp 4348 59EE.tmp 2644 5AA9.tmp 3448 5B93.tmp 848 5C6E.tmp 2528 5D49.tmp 4408 5E24.tmp 5968 5EFE.tmp 2012 6008.tmp 5180 60E3.tmp 5816 624A.tmp 4296 6325.tmp 5076 63C1.tmp 5928 644E.tmp 3916 6529.tmp 4436 65B5.tmp 5500 6642.tmp 5760 66BF.tmp 3796 671D.tmp 1520 67C8.tmp 1540 68C2.tmp 1224 697E.tmp 4672 69EB.tmp 3044 6A78.tmp 776 6B05.tmp 5168 6BA1.tmp 5460 6C8B.tmp 4176 6D18.tmp 2292 6D95.tmp 5356 6E12.tmp 4080 6E9E.tmp 4444 6F1B.tmp 1072 6FA8.tmp 4124 7025.tmp 3160 70C1.tmp 4252 714E.tmp 5112 71CB.tmp 5728 7258.tmp 2620 7303.tmp 304 73AF.tmp 1360 743C.tmp 1340 74C9.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5828.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7025.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8534.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3838.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F737.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 282A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 420B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6090.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1866.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 743C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D255.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 819A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 326B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E31E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 955C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B288.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8B9.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4920 wrote to memory of 1864 4920 2026-08-01_dfbdbc0fa9d0ccb98d79f7f9ab8e6845_elex_mafia_stealc_tofsee.exe 88 PID 1864 wrote to memory of 2592 1864 4637.tmp 90 PID 2592 wrote to memory of 3884 2592 46F2.tmp 91 PID 3884 wrote to memory of 4740 3884 47EC.tmp 92 PID 4740 wrote to memory of 1056 4740 4888.tmp 93 PID 1056 wrote to memory of 1796 1056 48F6.tmp 94 PID 1796 wrote to memory of 4732 1796 4AF9.tmp 95 PID 4732 wrote to memory of 5320 4732 4C51.tmp 96 PID 5320 wrote to memory of 5616 5320 4CCE.tmp 97 PID 5616 wrote to memory of 960 5616 4D5B.tmp 98 PID 960 wrote to memory of 4316 960 4E64.tmp 99 PID 4316 wrote to memory of 576 4316 4EE1.tmp 100 PID 576 wrote to memory of 5868 576 4FDB.tmp 101 PID 5868 wrote to memory of 2224 5868 50B6.tmp 102 PID 2224 wrote to memory of 3788 2224 5133.tmp 103 PID 3788 wrote to memory of 3540 3788 51A1.tmp 104 PID 3540 wrote to memory of 1948 3540 52F8.tmp 105 PID 1948 wrote to memory of 3292 1948 53E3.tmp 106 PID 3292 wrote to memory of 956 3292 54CD.tmp 107 PID 956 wrote to memory of 4604 956 55B7.tmp 108 PID 4604 wrote to memory of 2680 4604 5634.tmp 109 PID 2680 wrote to memory of 2532 2680 56F0.tmp 110 PID 2532 wrote to memory of 4816 2532 5828.tmp 111 PID 4816 wrote to memory of 4348 4816 5903.tmp 112 PID 4348 wrote to memory of 2644 4348 59EE.tmp 113 PID 2644 wrote to memory of 3448 2644 5AA9.tmp 114 PID 3448 wrote to memory of 848 3448 5B93.tmp 115 PID 848 wrote to memory of 2528 848 5C6E.tmp 116 PID 2528 wrote to memory of 4408 2528 5D49.tmp 117 PID 4408 wrote to memory of 5968 4408 5E24.tmp 118 PID 5968 wrote to memory of 2012 5968 5EFE.tmp 119 PID 2012 wrote to memory of 5180 2012 6008.tmp 120 PID 5180 wrote to memory of 5816 5180 60E3.tmp 121 PID 5816 wrote to memory of 4296 5816 624A.tmp 122 PID 4296 wrote to memory of 5076 4296 6325.tmp 123 PID 5076 wrote to memory of 5928 5076 63C1.tmp 124 PID 5928 wrote to memory of 3916 5928 644E.tmp 125 PID 3916 wrote to memory of 4436 3916 6529.tmp 126 PID 4436 wrote to memory of 5500 4436 65B5.tmp 127 PID 5500 wrote to memory of 5760 5500 6642.tmp 128 PID 5760 wrote to memory of 3796 5760 66BF.tmp 129 PID 3796 wrote to memory of 1520 3796 671D.tmp 130 PID 1520 wrote to memory of 1540 1520 67C8.tmp 131 PID 1540 wrote to memory of 1224 1540 68C2.tmp 132 PID 1224 wrote to memory of 4672 1224 697E.tmp 133 PID 4672 wrote to memory of 3044 4672 69EB.tmp 134 PID 3044 wrote to memory of 776 3044 6A78.tmp 135 PID 776 wrote to memory of 5168 776 6B05.tmp 136 PID 5168 wrote to memory of 5460 5168 6BA1.tmp 137 PID 5460 wrote to memory of 4176 5460 6C8B.tmp 138 PID 4176 wrote to memory of 2292 4176 6D18.tmp 139 PID 2292 wrote to memory of 5356 2292 6D95.tmp 140 PID 5356 wrote to memory of 4080 5356 6E12.tmp 141 PID 4080 wrote to memory of 4444 4080 6E9E.tmp 142 PID 4444 wrote to memory of 1072 4444 6F1B.tmp 143 PID 1072 wrote to memory of 4124 1072 6FA8.tmp 144 PID 4124 wrote to memory of 3160 4124 7025.tmp 145 PID 3160 wrote to memory of 4252 3160 70C1.tmp 146 PID 4252 wrote to memory of 5112 4252 714E.tmp 147 PID 5112 wrote to memory of 5728 5112 71CB.tmp 148 PID 5728 wrote to memory of 2620 5728 7258.tmp 149 PID 2620 wrote to memory of 304 2620 7303.tmp 150 PID 304 wrote to memory of 1360 304 73AF.tmp 151 PID 1360 wrote to memory of 1340 1360 743C.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_dfbdbc0fa9d0ccb98d79f7f9ab8e6845_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_dfbdbc0fa9d0ccb98d79f7f9ab8e6845_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\4637.tmp"C:\Users\Admin\AppData\Local\Temp\4637.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\46F2.tmp"C:\Users\Admin\AppData\Local\Temp\46F2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\47EC.tmp"C:\Users\Admin\AppData\Local\Temp\47EC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\4888.tmp"C:\Users\Admin\AppData\Local\Temp\4888.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\48F6.tmp"C:\Users\Admin\AppData\Local\Temp\48F6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\4AF9.tmp"C:\Users\Admin\AppData\Local\Temp\4AF9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\4C51.tmp"C:\Users\Admin\AppData\Local\Temp\4C51.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\4CCE.tmp"C:\Users\Admin\AppData\Local\Temp\4CCE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\4D5B.tmp"C:\Users\Admin\AppData\Local\Temp\4D5B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\4E64.tmp"C:\Users\Admin\AppData\Local\Temp\4E64.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\4FDB.tmp"C:\Users\Admin\AppData\Local\Temp\4FDB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\50B6.tmp"C:\Users\Admin\AppData\Local\Temp\50B6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\5133.tmp"C:\Users\Admin\AppData\Local\Temp\5133.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\51A1.tmp"C:\Users\Admin\AppData\Local\Temp\51A1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\52F8.tmp"C:\Users\Admin\AppData\Local\Temp\52F8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\53E3.tmp"C:\Users\Admin\AppData\Local\Temp\53E3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\54CD.tmp"C:\Users\Admin\AppData\Local\Temp\54CD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\55B7.tmp"C:\Users\Admin\AppData\Local\Temp\55B7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\5634.tmp"C:\Users\Admin\AppData\Local\Temp\5634.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\56F0.tmp"C:\Users\Admin\AppData\Local\Temp\56F0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\5828.tmp"C:\Users\Admin\AppData\Local\Temp\5828.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\5903.tmp"C:\Users\Admin\AppData\Local\Temp\5903.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\59EE.tmp"C:\Users\Admin\AppData\Local\Temp\59EE.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\5AA9.tmp"C:\Users\Admin\AppData\Local\Temp\5AA9.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\5B93.tmp"C:\Users\Admin\AppData\Local\Temp\5B93.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\5C6E.tmp"C:\Users\Admin\AppData\Local\Temp\5C6E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\5D49.tmp"C:\Users\Admin\AppData\Local\Temp\5D49.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\5E24.tmp"C:\Users\Admin\AppData\Local\Temp\5E24.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\5EFE.tmp"C:\Users\Admin\AppData\Local\Temp\5EFE.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\6008.tmp"C:\Users\Admin\AppData\Local\Temp\6008.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\60E3.tmp"C:\Users\Admin\AppData\Local\Temp\60E3.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\624A.tmp"C:\Users\Admin\AppData\Local\Temp\624A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\6325.tmp"C:\Users\Admin\AppData\Local\Temp\6325.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\63C1.tmp"C:\Users\Admin\AppData\Local\Temp\63C1.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\644E.tmp"C:\Users\Admin\AppData\Local\Temp\644E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\6529.tmp"C:\Users\Admin\AppData\Local\Temp\6529.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\65B5.tmp"C:\Users\Admin\AppData\Local\Temp\65B5.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\66BF.tmp"C:\Users\Admin\AppData\Local\Temp\66BF.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\671D.tmp"C:\Users\Admin\AppData\Local\Temp\671D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\68C2.tmp"C:\Users\Admin\AppData\Local\Temp\68C2.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\697E.tmp"C:\Users\Admin\AppData\Local\Temp\697E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\69EB.tmp"C:\Users\Admin\AppData\Local\Temp\69EB.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\6A78.tmp"C:\Users\Admin\AppData\Local\Temp\6A78.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\6B05.tmp"C:\Users\Admin\AppData\Local\Temp\6B05.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\6BA1.tmp"C:\Users\Admin\AppData\Local\Temp\6BA1.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\6C8B.tmp"C:\Users\Admin\AppData\Local\Temp\6C8B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\6D18.tmp"C:\Users\Admin\AppData\Local\Temp\6D18.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\6D95.tmp"C:\Users\Admin\AppData\Local\Temp\6D95.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\6E12.tmp"C:\Users\Admin\AppData\Local\Temp\6E12.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\6F1B.tmp"C:\Users\Admin\AppData\Local\Temp\6F1B.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\6FA8.tmp"C:\Users\Admin\AppData\Local\Temp\6FA8.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\7025.tmp"C:\Users\Admin\AppData\Local\Temp\7025.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\70C1.tmp"C:\Users\Admin\AppData\Local\Temp\70C1.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\714E.tmp"C:\Users\Admin\AppData\Local\Temp\714E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\71CB.tmp"C:\Users\Admin\AppData\Local\Temp\71CB.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\7258.tmp"C:\Users\Admin\AppData\Local\Temp\7258.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\7303.tmp"C:\Users\Admin\AppData\Local\Temp\7303.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\73AF.tmp"C:\Users\Admin\AppData\Local\Temp\73AF.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:304 -
C:\Users\Admin\AppData\Local\Temp\743C.tmp"C:\Users\Admin\AppData\Local\Temp\743C.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\74C9.tmp"C:\Users\Admin\AppData\Local\Temp\74C9.tmp"65⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\7565.tmp"C:\Users\Admin\AppData\Local\Temp\7565.tmp"66⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\7601.tmp"C:\Users\Admin\AppData\Local\Temp\7601.tmp"67⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\768E.tmp"C:\Users\Admin\AppData\Local\Temp\768E.tmp"68⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\771A.tmp"C:\Users\Admin\AppData\Local\Temp\771A.tmp"69⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\7797.tmp"C:\Users\Admin\AppData\Local\Temp\7797.tmp"70⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\7824.tmp"C:\Users\Admin\AppData\Local\Temp\7824.tmp"71⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\78C0.tmp"C:\Users\Admin\AppData\Local\Temp\78C0.tmp"72⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\793D.tmp"C:\Users\Admin\AppData\Local\Temp\793D.tmp"73⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\79AB.tmp"C:\Users\Admin\AppData\Local\Temp\79AB.tmp"74⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\7A47.tmp"C:\Users\Admin\AppData\Local\Temp\7A47.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"76⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\7B70.tmp"C:\Users\Admin\AppData\Local\Temp\7B70.tmp"77⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"78⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\7CB8.tmp"C:\Users\Admin\AppData\Local\Temp\7CB8.tmp"79⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\7D35.tmp"C:\Users\Admin\AppData\Local\Temp\7D35.tmp"80⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"81⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\7E3E.tmp"C:\Users\Admin\AppData\Local\Temp\7E3E.tmp"82⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\7EDB.tmp"C:\Users\Admin\AppData\Local\Temp\7EDB.tmp"83⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\7F67.tmp"C:\Users\Admin\AppData\Local\Temp\7F67.tmp"84⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\8004.tmp"C:\Users\Admin\AppData\Local\Temp\8004.tmp"85⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\8081.tmp"C:\Users\Admin\AppData\Local\Temp\8081.tmp"86⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\80FE.tmp"C:\Users\Admin\AppData\Local\Temp\80FE.tmp"87⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\819A.tmp"C:\Users\Admin\AppData\Local\Temp\819A.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\8236.tmp"C:\Users\Admin\AppData\Local\Temp\8236.tmp"89⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\82C3.tmp"C:\Users\Admin\AppData\Local\Temp\82C3.tmp"90⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\8340.tmp"C:\Users\Admin\AppData\Local\Temp\8340.tmp"91⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\83BD.tmp"C:\Users\Admin\AppData\Local\Temp\83BD.tmp"92⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\843A.tmp"C:\Users\Admin\AppData\Local\Temp\843A.tmp"93⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\84B7.tmp"C:\Users\Admin\AppData\Local\Temp\84B7.tmp"94⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\8534.tmp"C:\Users\Admin\AppData\Local\Temp\8534.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\85C0.tmp"C:\Users\Admin\AppData\Local\Temp\85C0.tmp"96⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\865D.tmp"C:\Users\Admin\AppData\Local\Temp\865D.tmp"97⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\86E9.tmp"C:\Users\Admin\AppData\Local\Temp\86E9.tmp"98⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\8776.tmp"C:\Users\Admin\AppData\Local\Temp\8776.tmp"99⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\87F3.tmp"C:\Users\Admin\AppData\Local\Temp\87F3.tmp"100⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\889F.tmp"C:\Users\Admin\AppData\Local\Temp\889F.tmp"101⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\893B.tmp"C:\Users\Admin\AppData\Local\Temp\893B.tmp"102⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\89C8.tmp"C:\Users\Admin\AppData\Local\Temp\89C8.tmp"103⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\8A54.tmp"C:\Users\Admin\AppData\Local\Temp\8A54.tmp"104⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"105⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"106⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"107⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"108⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"109⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\8D71.tmp"C:\Users\Admin\AppData\Local\Temp\8D71.tmp"110⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\8DEE.tmp"C:\Users\Admin\AppData\Local\Temp\8DEE.tmp"111⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\8E6B.tmp"C:\Users\Admin\AppData\Local\Temp\8E6B.tmp"112⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\8EF8.tmp"C:\Users\Admin\AppData\Local\Temp\8EF8.tmp"113⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\8F75.tmp"C:\Users\Admin\AppData\Local\Temp\8F75.tmp"114⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\9001.tmp"C:\Users\Admin\AppData\Local\Temp\9001.tmp"115⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\909E.tmp"C:\Users\Admin\AppData\Local\Temp\909E.tmp"116⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\913A.tmp"C:\Users\Admin\AppData\Local\Temp\913A.tmp"117⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\91E6.tmp"C:\Users\Admin\AppData\Local\Temp\91E6.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\9272.tmp"C:\Users\Admin\AppData\Local\Temp\9272.tmp"119⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\931E.tmp"C:\Users\Admin\AppData\Local\Temp\931E.tmp"120⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\939B.tmp"C:\Users\Admin\AppData\Local\Temp\939B.tmp"121⤵PID:5604
-
C:\Users\Admin\AppData\Local\Temp\9418.tmp"C:\Users\Admin\AppData\Local\Temp\9418.tmp"122⤵PID:620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-