Analysis
- max time kernel
131s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 13:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_9a662efbe5c10fccbe714b7b68a43810_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_9a662efbe5c10fccbe714b7b68a43810_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_9a662efbe5c10fccbe714b7b68a43810_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260802-ral3hsthpf
- SHA256 fbe35c48b45ecbd9d80acbe9d1a64b62d90539b46eea0ff8cbd2256ce00181ee
- MD5 9a662efbe5c10fccbe714b7b68a43810
- SHA1 514bf67de8748ae53b207a0f201845109cc0b85e
- SHA512 97b3ef49b2e9ab59a9422107d302ba2a2d54f5ac5e3510542084d5ac9faf5b543c94c60339bd0d89fd3c5aae7e479f74c79715f8f29f31b1398996fac17b0ab8
- SSDEEP 12288:wU5rCOTeiDEcAmYp43kVl3YNZ+3/v+I9hUG2VA:wUQOJDEz43k33YNGEA
- TLSH T1F2E4D02173D88532E5F7037869B5E6644E7EBD326722D6CF2B8025AE0DB1BD08671723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3080 B1F1.tmp 1964 B2BC.tmp 1848 B4DF.tmp 2876 B608.tmp 2800 B6D3.tmp 4088 B7DC.tmp 52 B8F6.tmp 3332 B9FF.tmp 5112 BAEA.tmp 5432 BBD4.tmp 1004 BCDE.tmp 2260 BDB8.tmp 5184 BEE1.tmp 5400 BFEB.tmp 4244 C133.tmp 3280 C21D.tmp 4976 C327.tmp 3652 C460.tmp 3012 C5C7.tmp 5804 C6FF.tmp 484 C828.tmp 4180 C913.tmp 256 CA3C.tmp 6132 CB26.tmp 3328 CC30.tmp 5488 CD68.tmp 6096 CE62.tmp 4996 CF8B.tmp 4564 D112.tmp 4460 D22B.tmp 5612 D363.tmp 5664 D46D.tmp 4756 D577.tmp 1224 D613.tmp 2156 D6CE.tmp 5900 D7A9.tmp 1756 D845.tmp 1972 D930.tmp 4792 DA0A.tmp 5748 DAA7.tmp 3964 DB81.tmp 2832 DC1E.tmp 5808 DCCA.tmp 432 DDB4.tmp 1672 DE7F.tmp 4716 DF3B.tmp 3164 E025.tmp 3928 E0C1.tmp 1268 E17D.tmp 1948 E1FA.tmp 3228 E296.tmp 4176 E323.tmp 1020 E390.tmp 3696 E41D.tmp 3704 E49A.tmp 5984 E545.tmp 4112 E5E2.tmp 5308 E65F.tmp 5324 E6EB.tmp 928 E778.tmp 2560 E814.tmp 4480 E891.tmp 2796 E91E.tmp 4896 E9BA.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2324.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_9a662efbe5c10fccbe714b7b68a43810_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E65F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 291.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9670.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3068.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3644.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8713.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1190.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D577.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 831C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E715.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3267.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3601.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 396C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B259.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1019.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E323.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2964 wrote to memory of 3080 2964 2026-08-02_9a662efbe5c10fccbe714b7b68a43810_elex_mafia_stealc_tofsee.exe 89 PID 3080 wrote to memory of 1964 3080 B1F1.tmp 90 PID 1964 wrote to memory of 1848 1964 B2BC.tmp 91 PID 1848 wrote to memory of 2876 1848 B4DF.tmp 92 PID 2876 wrote to memory of 2800 2876 B608.tmp 93 PID 2800 wrote to memory of 4088 2800 B6D3.tmp 94 PID 4088 wrote to memory of 52 4088 B7DC.tmp 95 PID 52 wrote to memory of 3332 52 B8F6.tmp 96 PID 3332 wrote to memory of 5112 3332 B9FF.tmp 97 PID 5112 wrote to memory of 5432 5112 BAEA.tmp 98 PID 5432 wrote to memory of 1004 5432 BBD4.tmp 99 PID 1004 wrote to memory of 2260 1004 BCDE.tmp 100 PID 2260 wrote to memory of 5184 2260 BDB8.tmp 101 PID 5184 wrote to memory of 5400 5184 BEE1.tmp 102 PID 5400 wrote to memory of 4244 5400 BFEB.tmp 103 PID 4244 wrote to memory of 3280 4244 C133.tmp 104 PID 3280 wrote to memory of 4976 3280 C21D.tmp 105 PID 4976 wrote to memory of 3652 4976 C327.tmp 106 PID 3652 wrote to memory of 3012 3652 C460.tmp 107 PID 3012 wrote to memory of 5804 3012 C5C7.tmp 108 PID 5804 wrote to memory of 484 5804 C6FF.tmp 109 PID 484 wrote to memory of 4180 484 C828.tmp 110 PID 4180 wrote to memory of 256 4180 C913.tmp 111 PID 256 wrote to memory of 6132 256 CA3C.tmp 112 PID 6132 wrote to memory of 3328 6132 CB26.tmp 113 PID 3328 wrote to memory of 5488 3328 CC30.tmp 114 PID 5488 wrote to memory of 6096 5488 CD68.tmp 115 PID 6096 wrote to memory of 4996 6096 CE62.tmp 116 PID 4996 wrote to memory of 4564 4996 CF8B.tmp 117 PID 4564 wrote to memory of 4460 4564 D112.tmp 118 PID 4460 wrote to memory of 5612 4460 D22B.tmp 119 PID 5612 wrote to memory of 5664 5612 D363.tmp 120 PID 5664 wrote to memory of 4756 5664 D46D.tmp 121 PID 4756 wrote to memory of 1224 4756 D577.tmp 122 PID 1224 wrote to memory of 2156 1224 D613.tmp 123 PID 2156 wrote to memory of 5900 2156 D6CE.tmp 124 PID 5900 wrote to memory of 1756 5900 D7A9.tmp 125 PID 1756 wrote to memory of 1972 1756 D845.tmp 126 PID 1972 wrote to memory of 4792 1972 D930.tmp 127 PID 4792 wrote to memory of 5748 4792 DA0A.tmp 128 PID 5748 wrote to memory of 3964 5748 DAA7.tmp 129 PID 3964 wrote to memory of 2832 3964 DB81.tmp 130 PID 2832 wrote to memory of 5808 2832 DC1E.tmp 131 PID 5808 wrote to memory of 432 5808 DCCA.tmp 132 PID 432 wrote to memory of 1672 432 DDB4.tmp 133 PID 1672 wrote to memory of 4716 1672 DE7F.tmp 134 PID 4716 wrote to memory of 3164 4716 DF3B.tmp 135 PID 3164 wrote to memory of 3928 3164 E025.tmp 136 PID 3928 wrote to memory of 1268 3928 E0C1.tmp 137 PID 1268 wrote to memory of 1948 1268 E17D.tmp 138 PID 1948 wrote to memory of 3228 1948 E1FA.tmp 139 PID 3228 wrote to memory of 4176 3228 E296.tmp 140 PID 4176 wrote to memory of 1020 4176 E323.tmp 141 PID 1020 wrote to memory of 3696 1020 E390.tmp 142 PID 3696 wrote to memory of 3704 3696 E41D.tmp 143 PID 3704 wrote to memory of 5984 3704 E49A.tmp 144 PID 5984 wrote to memory of 4112 5984 E545.tmp 145 PID 4112 wrote to memory of 5308 4112 E5E2.tmp 146 PID 5308 wrote to memory of 5324 5308 E65F.tmp 147 PID 5324 wrote to memory of 928 5324 E6EB.tmp 148 PID 928 wrote to memory of 2560 928 E778.tmp 149 PID 2560 wrote to memory of 4480 2560 E814.tmp 150 PID 4480 wrote to memory of 2796 4480 E891.tmp 151 PID 2796 wrote to memory of 4896 2796 E91E.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a662efbe5c10fccbe714b7b68a43810_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a662efbe5c10fccbe714b7b68a43810_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\B4DF.tmp"C:\Users\Admin\AppData\Local\Temp\B4DF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\B608.tmp"C:\Users\Admin\AppData\Local\Temp\B608.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\B6D3.tmp"C:\Users\Admin\AppData\Local\Temp\B6D3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\B7DC.tmp"C:\Users\Admin\AppData\Local\Temp\B7DC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\B8F6.tmp"C:\Users\Admin\AppData\Local\Temp\B8F6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Users\Admin\AppData\Local\Temp\B9FF.tmp"C:\Users\Admin\AppData\Local\Temp\B9FF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"C:\Users\Admin\AppData\Local\Temp\BBD4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\BCDE.tmp"C:\Users\Admin\AppData\Local\Temp\BCDE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\BDB8.tmp"C:\Users\Admin\AppData\Local\Temp\BDB8.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\C133.tmp"C:\Users\Admin\AppData\Local\Temp\C133.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\C21D.tmp"C:\Users\Admin\AppData\Local\Temp\C21D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\C327.tmp"C:\Users\Admin\AppData\Local\Temp\C327.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\C460.tmp"C:\Users\Admin\AppData\Local\Temp\C460.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\C5C7.tmp"C:\Users\Admin\AppData\Local\Temp\C5C7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\C828.tmp"C:\Users\Admin\AppData\Local\Temp\C828.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\C913.tmp"C:\Users\Admin\AppData\Local\Temp\C913.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\CA3C.tmp"C:\Users\Admin\AppData\Local\Temp\CA3C.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\CB26.tmp"C:\Users\Admin\AppData\Local\Temp\CB26.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\CC30.tmp"C:\Users\Admin\AppData\Local\Temp\CC30.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\CD68.tmp"C:\Users\Admin\AppData\Local\Temp\CD68.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\CE62.tmp"C:\Users\Admin\AppData\Local\Temp\CE62.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\D112.tmp"C:\Users\Admin\AppData\Local\Temp\D112.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\D22B.tmp"C:\Users\Admin\AppData\Local\Temp\D22B.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\D363.tmp"C:\Users\Admin\AppData\Local\Temp\D363.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\D46D.tmp"C:\Users\Admin\AppData\Local\Temp\D46D.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\D577.tmp"C:\Users\Admin\AppData\Local\Temp\D577.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\D613.tmp"C:\Users\Admin\AppData\Local\Temp\D613.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"C:\Users\Admin\AppData\Local\Temp\D6CE.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\D7A9.tmp"C:\Users\Admin\AppData\Local\Temp\D7A9.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\D845.tmp"C:\Users\Admin\AppData\Local\Temp\D845.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\D930.tmp"C:\Users\Admin\AppData\Local\Temp\D930.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\DAA7.tmp"C:\Users\Admin\AppData\Local\Temp\DAA7.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\DB81.tmp"C:\Users\Admin\AppData\Local\Temp\DB81.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\DC1E.tmp"C:\Users\Admin\AppData\Local\Temp\DC1E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"C:\Users\Admin\AppData\Local\Temp\DCCA.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\DE7F.tmp"C:\Users\Admin\AppData\Local\Temp\DE7F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"C:\Users\Admin\AppData\Local\Temp\DF3B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\E025.tmp"C:\Users\Admin\AppData\Local\Temp\E025.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\E17D.tmp"C:\Users\Admin\AppData\Local\Temp\E17D.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"C:\Users\Admin\AppData\Local\Temp\E1FA.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\E296.tmp"C:\Users\Admin\AppData\Local\Temp\E296.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\E323.tmp"C:\Users\Admin\AppData\Local\Temp\E323.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\E390.tmp"C:\Users\Admin\AppData\Local\Temp\E390.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\E41D.tmp"C:\Users\Admin\AppData\Local\Temp\E41D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\E49A.tmp"C:\Users\Admin\AppData\Local\Temp\E49A.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\E545.tmp"C:\Users\Admin\AppData\Local\Temp\E545.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\E5E2.tmp"C:\Users\Admin\AppData\Local\Temp\E5E2.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\E65F.tmp"C:\Users\Admin\AppData\Local\Temp\E65F.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\E778.tmp"C:\Users\Admin\AppData\Local\Temp\E778.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\E814.tmp"C:\Users\Admin\AppData\Local\Temp\E814.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\E891.tmp"C:\Users\Admin\AppData\Local\Temp\E891.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\E91E.tmp"C:\Users\Admin\AppData\Local\Temp\E91E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\E9BA.tmp"C:\Users\Admin\AppData\Local\Temp\E9BA.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\EA37.tmp"C:\Users\Admin\AppData\Local\Temp\EA37.tmp"66⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\EAC4.tmp"C:\Users\Admin\AppData\Local\Temp\EAC4.tmp"67⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\EB31.tmp"C:\Users\Admin\AppData\Local\Temp\EB31.tmp"68⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\EBDD.tmp"C:\Users\Admin\AppData\Local\Temp\EBDD.tmp"69⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\EC6A.tmp"C:\Users\Admin\AppData\Local\Temp\EC6A.tmp"70⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\ED06.tmp"C:\Users\Admin\AppData\Local\Temp\ED06.tmp"71⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\ED73.tmp"C:\Users\Admin\AppData\Local\Temp\ED73.tmp"72⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\EE00.tmp"C:\Users\Admin\AppData\Local\Temp\EE00.tmp"73⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\EE7D.tmp"C:\Users\Admin\AppData\Local\Temp\EE7D.tmp"74⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\EEFA.tmp"C:\Users\Admin\AppData\Local\Temp\EEFA.tmp"75⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\EF67.tmp"C:\Users\Admin\AppData\Local\Temp\EF67.tmp"76⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\F003.tmp"C:\Users\Admin\AppData\Local\Temp\F003.tmp"77⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\F080.tmp"C:\Users\Admin\AppData\Local\Temp\F080.tmp"78⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\F12C.tmp"C:\Users\Admin\AppData\Local\Temp\F12C.tmp"79⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\F1B9.tmp"C:\Users\Admin\AppData\Local\Temp\F1B9.tmp"80⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\F246.tmp"C:\Users\Admin\AppData\Local\Temp\F246.tmp"81⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"82⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\F35F.tmp"C:\Users\Admin\AppData\Local\Temp\F35F.tmp"83⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\F40B.tmp"C:\Users\Admin\AppData\Local\Temp\F40B.tmp"84⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\F4B7.tmp"C:\Users\Admin\AppData\Local\Temp\F4B7.tmp"85⤵PID:200
-
C:\Users\Admin\AppData\Local\Temp\F543.tmp"C:\Users\Admin\AppData\Local\Temp\F543.tmp"86⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\F5DF.tmp"C:\Users\Admin\AppData\Local\Temp\F5DF.tmp"87⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\F69B.tmp"C:\Users\Admin\AppData\Local\Temp\F69B.tmp"88⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\F737.tmp"C:\Users\Admin\AppData\Local\Temp\F737.tmp"89⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\F7B4.tmp"C:\Users\Admin\AppData\Local\Temp\F7B4.tmp"90⤵PID:5152
-
C:\Users\Admin\AppData\Local\Temp\F831.tmp"C:\Users\Admin\AppData\Local\Temp\F831.tmp"91⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"92⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\F95A.tmp"C:\Users\Admin\AppData\Local\Temp\F95A.tmp"93⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\FA44.tmp"C:\Users\Admin\AppData\Local\Temp\FA44.tmp"95⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\FAB2.tmp"C:\Users\Admin\AppData\Local\Temp\FAB2.tmp"96⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"97⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\FBCB.tmp"C:\Users\Admin\AppData\Local\Temp\FBCB.tmp"98⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\FC58.tmp"C:\Users\Admin\AppData\Local\Temp\FC58.tmp"99⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\FD04.tmp"C:\Users\Admin\AppData\Local\Temp\FD04.tmp"100⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\FDA0.tmp"C:\Users\Admin\AppData\Local\Temp\FDA0.tmp"101⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\FE4C.tmp"C:\Users\Admin\AppData\Local\Temp\FE4C.tmp"102⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\FEC9.tmp"C:\Users\Admin\AppData\Local\Temp\FEC9.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\FF55.tmp"C:\Users\Admin\AppData\Local\Temp\FF55.tmp"104⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"105⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\6F.tmp"C:\Users\Admin\AppData\Local\Temp\6F.tmp"106⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\EC.tmp"C:\Users\Admin\AppData\Local\Temp\EC.tmp"107⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\169.tmp"C:\Users\Admin\AppData\Local\Temp\169.tmp"108⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\1F5.tmp"C:\Users\Admin\AppData\Local\Temp\1F5.tmp"109⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\291.tmp"C:\Users\Admin\AppData\Local\Temp\291.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\32E.tmp"C:\Users\Admin\AppData\Local\Temp\32E.tmp"111⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\3BA.tmp"C:\Users\Admin\AppData\Local\Temp\3BA.tmp"112⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\437.tmp"C:\Users\Admin\AppData\Local\Temp\437.tmp"113⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\4B4.tmp"C:\Users\Admin\AppData\Local\Temp\4B4.tmp"114⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\531.tmp"C:\Users\Admin\AppData\Local\Temp\531.tmp"115⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\5BE.tmp"C:\Users\Admin\AppData\Local\Temp\5BE.tmp"116⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\63B.tmp"C:\Users\Admin\AppData\Local\Temp\63B.tmp"117⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\6D7.tmp"C:\Users\Admin\AppData\Local\Temp\6D7.tmp"118⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\764.tmp"C:\Users\Admin\AppData\Local\Temp\764.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\800.tmp"C:\Users\Admin\AppData\Local\Temp\800.tmp"120⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\8AC.tmp"C:\Users\Admin\AppData\Local\Temp\8AC.tmp"121⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\939.tmp"C:\Users\Admin\AppData\Local\Temp\939.tmp"122⤵PID:3292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-