Analysis
- max time kernel
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 14:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_5bee6d7e020f38ce0eff3f9c6184aa72_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_5bee6d7e020f38ce0eff3f9c6184aa72_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_5bee6d7e020f38ce0eff3f9c6184aa72_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260802-rq7ddsvdjg
- SHA256 3bd27cb74505303fe9e17963e8d52a5d83ac11f7a7df23629bf53a20be3e6998
- MD5 5bee6d7e020f38ce0eff3f9c6184aa72
- SHA1 4c4e0212af320ea03b6657bb5a33ba6a3920b02e
- SHA512 17f60bf56e4c24dc5abaa28b7acaeaceefb44a439c13a1d808a60abb7d85a1a3c413f14dede256f34fb7389e95d956661e090489c146eab9f9c90ae69953d73a
- SSDEEP 12288:wU5rCOTeiDSJa90P8HVNPyz049t08NZ+3/v+I9hUG2VA:wUQOJDc81JyT08NGEA
- TLSH T1AFE4D02177D88532E5FB037859B5E6654E7EBD22A722D6CF2FC011AE0971BC09A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1804 4116.tmp 4400 427E.tmp 3456 43D5.tmp 4504 453D.tmp 5208 45F8.tmp 3988 4675.tmp 1980 47AE.tmp 4132 48B7.tmp 2108 49C1.tmp 5856 4B28.tmp 4976 4C90.tmp 6128 4D99.tmp 120 4E74.tmp 4684 4F5E.tmp 1876 5078.tmp 3324 51B0.tmp 4532 52BA.tmp 1792 53B4.tmp 2140 54EC.tmp 5360 55F6.tmp 1692 573E.tmp 3512 5848.tmp 2252 5990.tmp 5524 5A8A.tmp 5904 5BA3.tmp 1524 5CAD.tmp 5672 5DF5.tmp 5388 5F1E.tmp 6008 6027.tmp 5688 616F.tmp 2764 6289.tmp 5712 6383.tmp 4804 64CB.tmp 2020 6567.tmp 1388 65F4.tmp 3384 66BF.tmp 2328 679A.tmp 1332 6894.tmp 1076 6930.tmp 5652 69EB.tmp 1420 6A88.tmp 5812 6B24.tmp 4256 6C1E.tmp 1628 6CBA.tmp 4188 6D47.tmp 4200 6DF3.tmp 5204 6EAE.tmp 2584 6F4A.tmp 5460 6FC7.tmp 3184 7044.tmp 4776 70E1.tmp 3248 717D.tmp 1864 71FA.tmp 5952 7286.tmp 5704 7313.tmp 1060 7380.tmp 4588 740D.tmp 5832 747A.tmp 4840 7507.tmp 2580 7584.tmp 3544 7601.tmp 1208 768E.tmp 4648 771A.tmp 3564 77A7.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5848.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C351.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B750.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F03D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D94A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C53A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 496E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C70A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 440F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B910.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D46D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A133.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B056.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 768E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2924.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D727.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 717D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D98D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C66E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A668.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F67C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E80F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2329.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29D0.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 916 wrote to memory of 1804 916 2026-08-02_5bee6d7e020f38ce0eff3f9c6184aa72_elex_mafia_stealc_tofsee.exe 89 PID 1804 wrote to memory of 4400 1804 4116.tmp 90 PID 4400 wrote to memory of 3456 4400 427E.tmp 91 PID 3456 wrote to memory of 4504 3456 43D5.tmp 92 PID 4504 wrote to memory of 5208 4504 453D.tmp 93 PID 5208 wrote to memory of 3988 5208 45F8.tmp 94 PID 3988 wrote to memory of 1980 3988 4675.tmp 95 PID 1980 wrote to memory of 4132 1980 47AE.tmp 96 PID 4132 wrote to memory of 2108 4132 48B7.tmp 97 PID 2108 wrote to memory of 5856 2108 49C1.tmp 98 PID 5856 wrote to memory of 4976 5856 4B28.tmp 99 PID 4976 wrote to memory of 6128 4976 4C90.tmp 100 PID 6128 wrote to memory of 120 6128 4D99.tmp 101 PID 120 wrote to memory of 4684 120 4E74.tmp 102 PID 4684 wrote to memory of 1876 4684 4F5E.tmp 103 PID 1876 wrote to memory of 3324 1876 5078.tmp 104 PID 3324 wrote to memory of 4532 3324 51B0.tmp 105 PID 4532 wrote to memory of 1792 4532 52BA.tmp 106 PID 1792 wrote to memory of 2140 1792 53B4.tmp 107 PID 2140 wrote to memory of 5360 2140 54EC.tmp 108 PID 5360 wrote to memory of 1692 5360 55F6.tmp 109 PID 1692 wrote to memory of 3512 1692 573E.tmp 110 PID 3512 wrote to memory of 2252 3512 5848.tmp 111 PID 2252 wrote to memory of 5524 2252 5990.tmp 112 PID 5524 wrote to memory of 5904 5524 5A8A.tmp 113 PID 5904 wrote to memory of 1524 5904 5BA3.tmp 114 PID 1524 wrote to memory of 5672 1524 5CAD.tmp 115 PID 5672 wrote to memory of 5388 5672 5DF5.tmp 116 PID 5388 wrote to memory of 6008 5388 5F1E.tmp 117 PID 6008 wrote to memory of 5688 6008 6027.tmp 118 PID 5688 wrote to memory of 2764 5688 616F.tmp 119 PID 2764 wrote to memory of 5712 2764 6289.tmp 120 PID 5712 wrote to memory of 4804 5712 6383.tmp 121 PID 4804 wrote to memory of 2020 4804 64CB.tmp 122 PID 2020 wrote to memory of 1388 2020 6567.tmp 123 PID 1388 wrote to memory of 3384 1388 65F4.tmp 124 PID 3384 wrote to memory of 2328 3384 66BF.tmp 125 PID 2328 wrote to memory of 1332 2328 679A.tmp 126 PID 1332 wrote to memory of 1076 1332 6894.tmp 127 PID 1076 wrote to memory of 5652 1076 6930.tmp 128 PID 5652 wrote to memory of 1420 5652 69EB.tmp 129 PID 1420 wrote to memory of 5812 1420 6A88.tmp 130 PID 5812 wrote to memory of 4256 5812 6B24.tmp 131 PID 4256 wrote to memory of 1628 4256 6C1E.tmp 132 PID 1628 wrote to memory of 4188 1628 6CBA.tmp 133 PID 4188 wrote to memory of 4200 4188 6D47.tmp 134 PID 4200 wrote to memory of 5204 4200 6DF3.tmp 135 PID 5204 wrote to memory of 2584 5204 6EAE.tmp 136 PID 2584 wrote to memory of 5460 2584 6F4A.tmp 137 PID 5460 wrote to memory of 3184 5460 6FC7.tmp 138 PID 3184 wrote to memory of 4776 3184 7044.tmp 139 PID 4776 wrote to memory of 3248 4776 70E1.tmp 140 PID 3248 wrote to memory of 1864 3248 717D.tmp 141 PID 1864 wrote to memory of 5952 1864 71FA.tmp 142 PID 5952 wrote to memory of 5704 5952 7286.tmp 143 PID 5704 wrote to memory of 1060 5704 7313.tmp 144 PID 1060 wrote to memory of 4588 1060 7380.tmp 145 PID 4588 wrote to memory of 5832 4588 740D.tmp 146 PID 5832 wrote to memory of 4840 5832 747A.tmp 147 PID 4840 wrote to memory of 2580 4840 7507.tmp 148 PID 2580 wrote to memory of 3544 2580 7584.tmp 149 PID 3544 wrote to memory of 1208 3544 7601.tmp 150 PID 1208 wrote to memory of 4648 1208 768E.tmp 151 PID 4648 wrote to memory of 3564 4648 771A.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_5bee6d7e020f38ce0eff3f9c6184aa72_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_5bee6d7e020f38ce0eff3f9c6184aa72_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\427E.tmp"C:\Users\Admin\AppData\Local\Temp\427E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\43D5.tmp"C:\Users\Admin\AppData\Local\Temp\43D5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\453D.tmp"C:\Users\Admin\AppData\Local\Temp\453D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\45F8.tmp"C:\Users\Admin\AppData\Local\Temp\45F8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5208 -
C:\Users\Admin\AppData\Local\Temp\4675.tmp"C:\Users\Admin\AppData\Local\Temp\4675.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\47AE.tmp"C:\Users\Admin\AppData\Local\Temp\47AE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\48B7.tmp"C:\Users\Admin\AppData\Local\Temp\48B7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\49C1.tmp"C:\Users\Admin\AppData\Local\Temp\49C1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\4B28.tmp"C:\Users\Admin\AppData\Local\Temp\4B28.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\4C90.tmp"C:\Users\Admin\AppData\Local\Temp\4C90.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\4D99.tmp"C:\Users\Admin\AppData\Local\Temp\4D99.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\4E74.tmp"C:\Users\Admin\AppData\Local\Temp\4E74.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Users\Admin\AppData\Local\Temp\4F5E.tmp"C:\Users\Admin\AppData\Local\Temp\4F5E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\5078.tmp"C:\Users\Admin\AppData\Local\Temp\5078.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\51B0.tmp"C:\Users\Admin\AppData\Local\Temp\51B0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\52BA.tmp"C:\Users\Admin\AppData\Local\Temp\52BA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\53B4.tmp"C:\Users\Admin\AppData\Local\Temp\53B4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\54EC.tmp"C:\Users\Admin\AppData\Local\Temp\54EC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\55F6.tmp"C:\Users\Admin\AppData\Local\Temp\55F6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\573E.tmp"C:\Users\Admin\AppData\Local\Temp\573E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\5848.tmp"C:\Users\Admin\AppData\Local\Temp\5848.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\5990.tmp"C:\Users\Admin\AppData\Local\Temp\5990.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\5A8A.tmp"C:\Users\Admin\AppData\Local\Temp\5A8A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\5BA3.tmp"C:\Users\Admin\AppData\Local\Temp\5BA3.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\5CAD.tmp"C:\Users\Admin\AppData\Local\Temp\5CAD.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\5DF5.tmp"C:\Users\Admin\AppData\Local\Temp\5DF5.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\5F1E.tmp"C:\Users\Admin\AppData\Local\Temp\5F1E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\6027.tmp"C:\Users\Admin\AppData\Local\Temp\6027.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\616F.tmp"C:\Users\Admin\AppData\Local\Temp\616F.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\6289.tmp"C:\Users\Admin\AppData\Local\Temp\6289.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\6383.tmp"C:\Users\Admin\AppData\Local\Temp\6383.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\6567.tmp"C:\Users\Admin\AppData\Local\Temp\6567.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\65F4.tmp"C:\Users\Admin\AppData\Local\Temp\65F4.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\66BF.tmp"C:\Users\Admin\AppData\Local\Temp\66BF.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\679A.tmp"C:\Users\Admin\AppData\Local\Temp\679A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\6894.tmp"C:\Users\Admin\AppData\Local\Temp\6894.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\6930.tmp"C:\Users\Admin\AppData\Local\Temp\6930.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\69EB.tmp"C:\Users\Admin\AppData\Local\Temp\69EB.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\6A88.tmp"C:\Users\Admin\AppData\Local\Temp\6A88.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\6B24.tmp"C:\Users\Admin\AppData\Local\Temp\6B24.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\6C1E.tmp"C:\Users\Admin\AppData\Local\Temp\6C1E.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\6CBA.tmp"C:\Users\Admin\AppData\Local\Temp\6CBA.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\6D47.tmp"C:\Users\Admin\AppData\Local\Temp\6D47.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\6EAE.tmp"C:\Users\Admin\AppData\Local\Temp\6EAE.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Users\Admin\AppData\Local\Temp\6F4A.tmp"C:\Users\Admin\AppData\Local\Temp\6F4A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\6FC7.tmp"C:\Users\Admin\AppData\Local\Temp\6FC7.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\7044.tmp"C:\Users\Admin\AppData\Local\Temp\7044.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\70E1.tmp"C:\Users\Admin\AppData\Local\Temp\70E1.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\717D.tmp"C:\Users\Admin\AppData\Local\Temp\717D.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\71FA.tmp"C:\Users\Admin\AppData\Local\Temp\71FA.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\7286.tmp"C:\Users\Admin\AppData\Local\Temp\7286.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\7313.tmp"C:\Users\Admin\AppData\Local\Temp\7313.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\7380.tmp"C:\Users\Admin\AppData\Local\Temp\7380.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\740D.tmp"C:\Users\Admin\AppData\Local\Temp\740D.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\747A.tmp"C:\Users\Admin\AppData\Local\Temp\747A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\7507.tmp"C:\Users\Admin\AppData\Local\Temp\7507.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\7584.tmp"C:\Users\Admin\AppData\Local\Temp\7584.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\7601.tmp"C:\Users\Admin\AppData\Local\Temp\7601.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\768E.tmp"C:\Users\Admin\AppData\Local\Temp\768E.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\771A.tmp"C:\Users\Admin\AppData\Local\Temp\771A.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\77A7.tmp"C:\Users\Admin\AppData\Local\Temp\77A7.tmp"65⤵
- Executes dropped EXE
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\7834.tmp"C:\Users\Admin\AppData\Local\Temp\7834.tmp"66⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\78C0.tmp"C:\Users\Admin\AppData\Local\Temp\78C0.tmp"67⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\793D.tmp"C:\Users\Admin\AppData\Local\Temp\793D.tmp"68⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\79BA.tmp"C:\Users\Admin\AppData\Local\Temp\79BA.tmp"69⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\7A37.tmp"C:\Users\Admin\AppData\Local\Temp\7A37.tmp"70⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"C:\Users\Admin\AppData\Local\Temp\7AC4.tmp"71⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\7B50.tmp"C:\Users\Admin\AppData\Local\Temp\7B50.tmp"72⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\7BDD.tmp"C:\Users\Admin\AppData\Local\Temp\7BDD.tmp"73⤵PID:260
-
C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"74⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\7CE7.tmp"C:\Users\Admin\AppData\Local\Temp\7CE7.tmp"75⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\7D54.tmp"C:\Users\Admin\AppData\Local\Temp\7D54.tmp"76⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"77⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\7E6D.tmp"C:\Users\Admin\AppData\Local\Temp\7E6D.tmp"78⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"79⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\7F87.tmp"C:\Users\Admin\AppData\Local\Temp\7F87.tmp"80⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\8013.tmp"C:\Users\Admin\AppData\Local\Temp\8013.tmp"81⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\8090.tmp"C:\Users\Admin\AppData\Local\Temp\8090.tmp"82⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\811D.tmp"C:\Users\Admin\AppData\Local\Temp\811D.tmp"83⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\819A.tmp"C:\Users\Admin\AppData\Local\Temp\819A.tmp"84⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\8217.tmp"C:\Users\Admin\AppData\Local\Temp\8217.tmp"85⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\82A3.tmp"C:\Users\Admin\AppData\Local\Temp\82A3.tmp"86⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\8311.tmp"C:\Users\Admin\AppData\Local\Temp\8311.tmp"87⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\839D.tmp"C:\Users\Admin\AppData\Local\Temp\839D.tmp"88⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\841A.tmp"C:\Users\Admin\AppData\Local\Temp\841A.tmp"89⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\84B7.tmp"C:\Users\Admin\AppData\Local\Temp\84B7.tmp"90⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\8553.tmp"C:\Users\Admin\AppData\Local\Temp\8553.tmp"91⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\85E0.tmp"C:\Users\Admin\AppData\Local\Temp\85E0.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\864D.tmp"C:\Users\Admin\AppData\Local\Temp\864D.tmp"93⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\86BA.tmp"C:\Users\Admin\AppData\Local\Temp\86BA.tmp"94⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\8757.tmp"C:\Users\Admin\AppData\Local\Temp\8757.tmp"95⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\87F3.tmp"C:\Users\Admin\AppData\Local\Temp\87F3.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\8870.tmp"C:\Users\Admin\AppData\Local\Temp\8870.tmp"97⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\88ED.tmp"C:\Users\Admin\AppData\Local\Temp\88ED.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\895A.tmp"C:\Users\Admin\AppData\Local\Temp\895A.tmp"99⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\89E7.tmp"C:\Users\Admin\AppData\Local\Temp\89E7.tmp"100⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\8A83.tmp"C:\Users\Admin\AppData\Local\Temp\8A83.tmp"101⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\8B00.tmp"C:\Users\Admin\AppData\Local\Temp\8B00.tmp"102⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"103⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"104⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"105⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\8D13.tmp"C:\Users\Admin\AppData\Local\Temp\8D13.tmp"106⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\8D81.tmp"C:\Users\Admin\AppData\Local\Temp\8D81.tmp"107⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"C:\Users\Admin\AppData\Local\Temp\8E2D.tmp"108⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"C:\Users\Admin\AppData\Local\Temp\8EB9.tmp"109⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\8F46.tmp"C:\Users\Admin\AppData\Local\Temp\8F46.tmp"110⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"111⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\9040.tmp"C:\Users\Admin\AppData\Local\Temp\9040.tmp"112⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\90BD.tmp"C:\Users\Admin\AppData\Local\Temp\90BD.tmp"113⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\913A.tmp"C:\Users\Admin\AppData\Local\Temp\913A.tmp"114⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\91B7.tmp"C:\Users\Admin\AppData\Local\Temp\91B7.tmp"115⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\9234.tmp"C:\Users\Admin\AppData\Local\Temp\9234.tmp"116⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\92B1.tmp"C:\Users\Admin\AppData\Local\Temp\92B1.tmp"117⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\934D.tmp"C:\Users\Admin\AppData\Local\Temp\934D.tmp"118⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\93CA.tmp"C:\Users\Admin\AppData\Local\Temp\93CA.tmp"119⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\9437.tmp"C:\Users\Admin\AppData\Local\Temp\9437.tmp"120⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\94C4.tmp"C:\Users\Admin\AppData\Local\Temp\94C4.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\9541.tmp"C:\Users\Admin\AppData\Local\Temp\9541.tmp"122⤵PID:4988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-