Analysis
- max time kernel
117s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 14:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_3ec09c5742df89a795ee0291d3c3e3d7_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_3ec09c5742df89a795ee0291d3c3e3d7_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_3ec09c5742df89a795ee0291d3c3e3d7_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260802-ryg4gabe29
- SHA256 ec03cfba008a838cbbd61b565e75dc03be0a4e374fded5a2d089494d0a532b63
- MD5 3ec09c5742df89a795ee0291d3c3e3d7
- SHA1 2490f2ce4c423e67b7afbef2a655c89aaaf96ae9
- SHA512 189060da91801af7a3626ce3327239a6975dead8fa6ddb7f84885cbd637fb9548b8a61563c585e7f6698ce93a1e852b16d7e1a4f7ebb38a55e346fb5e4eb83e9
- SSDEEP 12288:9U5rCOTei6l78QBLZ2urSzRdaBstEN+Ntheb1qZoXWjdq:9UQOJ6V9BLZ2fRdaBsuNt1qqGh
- TLSH T1D6C4F1227685C032E6D212314EE6EBB5297B7C354B2694CB3B94676E6FB42D1E334307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4672 5BE2.tmp 1812 5C9D.tmp 1276 5D68.tmp 1196 5E04.tmp 2488 5E91.tmp 2920 5F8B.tmp 3088 6027.tmp 4472 60F2.tmp 1616 619E.tmp 1804 623B.tmp 4268 6306.tmp 3912 63D1.tmp 3752 644E.tmp 3028 64EA.tmp 3280 65D4.tmp 5688 6690.tmp 1000 673C.tmp 4744 6807.tmp 5040 68B3.tmp 3240 694F.tmp 2176 69DC.tmp 6096 6A59.tmp 5616 6B14.tmp 6128 6BB0.tmp 2428 6C8B.tmp 1352 6D37.tmp 2416 6DF3.tmp 4552 6E9E.tmp 3244 6F6A.tmp 4660 7044.tmp 3656 7100.tmp 620 719C.tmp 4948 7229.tmp 5508 72A6.tmp 6064 7313.tmp 1972 7390.tmp 5704 741D.tmp 5932 749A.tmp 2124 7507.tmp 2340 75B3.tmp 712 7640.tmp 2672 76EB.tmp 5376 7778.tmp 4504 7814.tmp 952 7891.tmp 3984 792E.tmp 728 79AB.tmp 2800 7A28.tmp 2432 7AA5.tmp 4924 7B22.tmp 3216 7B9F.tmp 924 7C3B.tmp 2128 7CD7.tmp 4908 7D64.tmp 5740 7DF0.tmp 3852 7E7D.tmp 1364 7F29.tmp 3000 7F96.tmp 1112 8023.tmp 2380 80AF.tmp 4664 813C.tmp 5640 81A9.tmp 5924 8217.tmp 1144 82B3.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8795.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A166.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D795.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9730.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E773.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F975.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8927.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F658.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 223A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 716.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C16D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F05C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 471.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1847.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6027.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F35F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F473.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1123.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 642A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D293.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3970.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 474B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A22D.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2932 wrote to memory of 4672 2932 2026-08-02_3ec09c5742df89a795ee0291d3c3e3d7_elex_mafia_stealc_tofsee.exe 90 PID 4672 wrote to memory of 1812 4672 5BE2.tmp 91 PID 1812 wrote to memory of 1276 1812 5C9D.tmp 92 PID 1276 wrote to memory of 1196 1276 5D68.tmp 93 PID 1196 wrote to memory of 2488 1196 5E04.tmp 94 PID 2488 wrote to memory of 2920 2488 5E91.tmp 95 PID 2920 wrote to memory of 3088 2920 5F8B.tmp 96 PID 3088 wrote to memory of 4472 3088 6027.tmp 97 PID 4472 wrote to memory of 1616 4472 60F2.tmp 98 PID 1616 wrote to memory of 1804 1616 619E.tmp 99 PID 1804 wrote to memory of 4268 1804 623B.tmp 100 PID 4268 wrote to memory of 3912 4268 6306.tmp 101 PID 3912 wrote to memory of 3752 3912 63D1.tmp 102 PID 3752 wrote to memory of 3028 3752 644E.tmp 103 PID 3028 wrote to memory of 3280 3028 64EA.tmp 104 PID 3280 wrote to memory of 5688 3280 65D4.tmp 105 PID 5688 wrote to memory of 1000 5688 6690.tmp 106 PID 1000 wrote to memory of 4744 1000 673C.tmp 107 PID 4744 wrote to memory of 5040 4744 6807.tmp 108 PID 5040 wrote to memory of 3240 5040 68B3.tmp 109 PID 3240 wrote to memory of 2176 3240 694F.tmp 110 PID 2176 wrote to memory of 6096 2176 69DC.tmp 111 PID 6096 wrote to memory of 5616 6096 6A59.tmp 112 PID 5616 wrote to memory of 6128 5616 6B14.tmp 113 PID 6128 wrote to memory of 2428 6128 6BB0.tmp 114 PID 2428 wrote to memory of 1352 2428 6C8B.tmp 115 PID 1352 wrote to memory of 2416 1352 6D37.tmp 116 PID 2416 wrote to memory of 4552 2416 6DF3.tmp 117 PID 4552 wrote to memory of 3244 4552 6E9E.tmp 118 PID 3244 wrote to memory of 4660 3244 6F6A.tmp 119 PID 4660 wrote to memory of 3656 4660 7044.tmp 120 PID 3656 wrote to memory of 620 3656 7100.tmp 121 PID 620 wrote to memory of 4948 620 719C.tmp 122 PID 4948 wrote to memory of 5508 4948 7229.tmp 123 PID 5508 wrote to memory of 6064 5508 72A6.tmp 124 PID 6064 wrote to memory of 1972 6064 7313.tmp 125 PID 1972 wrote to memory of 5704 1972 7390.tmp 126 PID 5704 wrote to memory of 5932 5704 741D.tmp 127 PID 5932 wrote to memory of 2124 5932 749A.tmp 128 PID 2124 wrote to memory of 2340 2124 7507.tmp 129 PID 2340 wrote to memory of 712 2340 75B3.tmp 130 PID 712 wrote to memory of 2672 712 7640.tmp 131 PID 2672 wrote to memory of 5376 2672 76EB.tmp 132 PID 5376 wrote to memory of 4504 5376 7778.tmp 133 PID 4504 wrote to memory of 952 4504 7814.tmp 134 PID 952 wrote to memory of 3984 952 7891.tmp 135 PID 3984 wrote to memory of 728 3984 792E.tmp 136 PID 728 wrote to memory of 2800 728 79AB.tmp 137 PID 2800 wrote to memory of 2432 2800 7A28.tmp 138 PID 2432 wrote to memory of 4924 2432 7AA5.tmp 139 PID 4924 wrote to memory of 3216 4924 7B22.tmp 140 PID 3216 wrote to memory of 924 3216 7B9F.tmp 141 PID 924 wrote to memory of 2128 924 7C3B.tmp 142 PID 2128 wrote to memory of 4908 2128 7CD7.tmp 143 PID 4908 wrote to memory of 5740 4908 7D64.tmp 144 PID 5740 wrote to memory of 3852 5740 7DF0.tmp 145 PID 3852 wrote to memory of 1364 3852 7E7D.tmp 146 PID 1364 wrote to memory of 3000 1364 7F29.tmp 147 PID 3000 wrote to memory of 1112 3000 7F96.tmp 148 PID 1112 wrote to memory of 2380 1112 8023.tmp 149 PID 2380 wrote to memory of 4664 2380 80AF.tmp 150 PID 4664 wrote to memory of 5640 4664 813C.tmp 151 PID 5640 wrote to memory of 5924 5640 81A9.tmp 152 PID 5924 wrote to memory of 1144 5924 8217.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_3ec09c5742df89a795ee0291d3c3e3d7_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_3ec09c5742df89a795ee0291d3c3e3d7_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\5BE2.tmp"C:\Users\Admin\AppData\Local\Temp\5BE2.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\5C9D.tmp"C:\Users\Admin\AppData\Local\Temp\5C9D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\5D68.tmp"C:\Users\Admin\AppData\Local\Temp\5D68.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\5E04.tmp"C:\Users\Admin\AppData\Local\Temp\5E04.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\5E91.tmp"C:\Users\Admin\AppData\Local\Temp\5E91.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\5F8B.tmp"C:\Users\Admin\AppData\Local\Temp\5F8B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\6027.tmp"C:\Users\Admin\AppData\Local\Temp\6027.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\60F2.tmp"C:\Users\Admin\AppData\Local\Temp\60F2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\619E.tmp"C:\Users\Admin\AppData\Local\Temp\619E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\623B.tmp"C:\Users\Admin\AppData\Local\Temp\623B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\6306.tmp"C:\Users\Admin\AppData\Local\Temp\6306.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\63D1.tmp"C:\Users\Admin\AppData\Local\Temp\63D1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\644E.tmp"C:\Users\Admin\AppData\Local\Temp\644E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\64EA.tmp"C:\Users\Admin\AppData\Local\Temp\64EA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\65D4.tmp"C:\Users\Admin\AppData\Local\Temp\65D4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\6690.tmp"C:\Users\Admin\AppData\Local\Temp\6690.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\673C.tmp"C:\Users\Admin\AppData\Local\Temp\673C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\6807.tmp"C:\Users\Admin\AppData\Local\Temp\6807.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\68B3.tmp"C:\Users\Admin\AppData\Local\Temp\68B3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\694F.tmp"C:\Users\Admin\AppData\Local\Temp\694F.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\69DC.tmp"C:\Users\Admin\AppData\Local\Temp\69DC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\6A59.tmp"C:\Users\Admin\AppData\Local\Temp\6A59.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\6B14.tmp"C:\Users\Admin\AppData\Local\Temp\6B14.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\6BB0.tmp"C:\Users\Admin\AppData\Local\Temp\6BB0.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\6C8B.tmp"C:\Users\Admin\AppData\Local\Temp\6C8B.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\6D37.tmp"C:\Users\Admin\AppData\Local\Temp\6D37.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"C:\Users\Admin\AppData\Local\Temp\6DF3.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"C:\Users\Admin\AppData\Local\Temp\6E9E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\6F6A.tmp"C:\Users\Admin\AppData\Local\Temp\6F6A.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\7044.tmp"C:\Users\Admin\AppData\Local\Temp\7044.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\7100.tmp"C:\Users\Admin\AppData\Local\Temp\7100.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\719C.tmp"C:\Users\Admin\AppData\Local\Temp\719C.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\7229.tmp"C:\Users\Admin\AppData\Local\Temp\7229.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\72A6.tmp"C:\Users\Admin\AppData\Local\Temp\72A6.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\7313.tmp"C:\Users\Admin\AppData\Local\Temp\7313.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\7390.tmp"C:\Users\Admin\AppData\Local\Temp\7390.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\741D.tmp"C:\Users\Admin\AppData\Local\Temp\741D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\749A.tmp"C:\Users\Admin\AppData\Local\Temp\749A.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\7507.tmp"C:\Users\Admin\AppData\Local\Temp\7507.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\75B3.tmp"C:\Users\Admin\AppData\Local\Temp\75B3.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\7640.tmp"C:\Users\Admin\AppData\Local\Temp\7640.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\76EB.tmp"C:\Users\Admin\AppData\Local\Temp\76EB.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\7778.tmp"C:\Users\Admin\AppData\Local\Temp\7778.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\7814.tmp"C:\Users\Admin\AppData\Local\Temp\7814.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\7891.tmp"C:\Users\Admin\AppData\Local\Temp\7891.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\792E.tmp"C:\Users\Admin\AppData\Local\Temp\792E.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\79AB.tmp"C:\Users\Admin\AppData\Local\Temp\79AB.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Users\Admin\AppData\Local\Temp\7A28.tmp"C:\Users\Admin\AppData\Local\Temp\7A28.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\7AA5.tmp"C:\Users\Admin\AppData\Local\Temp\7AA5.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\7B22.tmp"C:\Users\Admin\AppData\Local\Temp\7B22.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\7B9F.tmp"C:\Users\Admin\AppData\Local\Temp\7B9F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"C:\Users\Admin\AppData\Local\Temp\7C3B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\7CD7.tmp"C:\Users\Admin\AppData\Local\Temp\7CD7.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\7D64.tmp"C:\Users\Admin\AppData\Local\Temp\7D64.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"C:\Users\Admin\AppData\Local\Temp\7DF0.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"C:\Users\Admin\AppData\Local\Temp\7E7D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\7F29.tmp"C:\Users\Admin\AppData\Local\Temp\7F29.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\7F96.tmp"C:\Users\Admin\AppData\Local\Temp\7F96.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\8023.tmp"C:\Users\Admin\AppData\Local\Temp\8023.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\80AF.tmp"C:\Users\Admin\AppData\Local\Temp\80AF.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\813C.tmp"C:\Users\Admin\AppData\Local\Temp\813C.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\81A9.tmp"C:\Users\Admin\AppData\Local\Temp\81A9.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\8217.tmp"C:\Users\Admin\AppData\Local\Temp\8217.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\82B3.tmp"C:\Users\Admin\AppData\Local\Temp\82B3.tmp"65⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\836F.tmp"C:\Users\Admin\AppData\Local\Temp\836F.tmp"66⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\83DC.tmp"C:\Users\Admin\AppData\Local\Temp\83DC.tmp"67⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\8469.tmp"C:\Users\Admin\AppData\Local\Temp\8469.tmp"68⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\84E6.tmp"C:\Users\Admin\AppData\Local\Temp\84E6.tmp"69⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\8572.tmp"C:\Users\Admin\AppData\Local\Temp\8572.tmp"70⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\861E.tmp"C:\Users\Admin\AppData\Local\Temp\861E.tmp"71⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\869B.tmp"C:\Users\Admin\AppData\Local\Temp\869B.tmp"72⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\8708.tmp"C:\Users\Admin\AppData\Local\Temp\8708.tmp"73⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\8795.tmp"C:\Users\Admin\AppData\Local\Temp\8795.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\8841.tmp"C:\Users\Admin\AppData\Local\Temp\8841.tmp"75⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\88AE.tmp"C:\Users\Admin\AppData\Local\Temp\88AE.tmp"76⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\892B.tmp"C:\Users\Admin\AppData\Local\Temp\892B.tmp"77⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\89C8.tmp"C:\Users\Admin\AppData\Local\Temp\89C8.tmp"78⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\8A45.tmp"C:\Users\Admin\AppData\Local\Temp\8A45.tmp"79⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"80⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\8B6D.tmp"C:\Users\Admin\AppData\Local\Temp\8B6D.tmp"81⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\8BEA.tmp"C:\Users\Admin\AppData\Local\Temp\8BEA.tmp"82⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\8C77.tmp"C:\Users\Admin\AppData\Local\Temp\8C77.tmp"83⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\8D04.tmp"C:\Users\Admin\AppData\Local\Temp\8D04.tmp"84⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"85⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\8E1D.tmp"C:\Users\Admin\AppData\Local\Temp\8E1D.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\8EAA.tmp"C:\Users\Admin\AppData\Local\Temp\8EAA.tmp"87⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\8F55.tmp"C:\Users\Admin\AppData\Local\Temp\8F55.tmp"88⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"C:\Users\Admin\AppData\Local\Temp\8FC3.tmp"89⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\9030.tmp"C:\Users\Admin\AppData\Local\Temp\9030.tmp"90⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\90CC.tmp"C:\Users\Admin\AppData\Local\Temp\90CC.tmp"91⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\9159.tmp"C:\Users\Admin\AppData\Local\Temp\9159.tmp"92⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\91D6.tmp"C:\Users\Admin\AppData\Local\Temp\91D6.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\9282.tmp"C:\Users\Admin\AppData\Local\Temp\9282.tmp"94⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\930F.tmp"C:\Users\Admin\AppData\Local\Temp\930F.tmp"95⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\937C.tmp"C:\Users\Admin\AppData\Local\Temp\937C.tmp"96⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\93E9.tmp"C:\Users\Admin\AppData\Local\Temp\93E9.tmp"97⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\9476.tmp"C:\Users\Admin\AppData\Local\Temp\9476.tmp"98⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\94F3.tmp"C:\Users\Admin\AppData\Local\Temp\94F3.tmp"99⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\9560.tmp"C:\Users\Admin\AppData\Local\Temp\9560.tmp"100⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\95DD.tmp"C:\Users\Admin\AppData\Local\Temp\95DD.tmp"101⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\967A.tmp"C:\Users\Admin\AppData\Local\Temp\967A.tmp"102⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\9716.tmp"C:\Users\Admin\AppData\Local\Temp\9716.tmp"103⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\9793.tmp"C:\Users\Admin\AppData\Local\Temp\9793.tmp"104⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\981F.tmp"C:\Users\Admin\AppData\Local\Temp\981F.tmp"105⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\98CB.tmp"C:\Users\Admin\AppData\Local\Temp\98CB.tmp"106⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\9948.tmp"C:\Users\Admin\AppData\Local\Temp\9948.tmp"107⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\99F4.tmp"C:\Users\Admin\AppData\Local\Temp\99F4.tmp"108⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\9A62.tmp"C:\Users\Admin\AppData\Local\Temp\9A62.tmp"109⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\9ADF.tmp"C:\Users\Admin\AppData\Local\Temp\9ADF.tmp"110⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"C:\Users\Admin\AppData\Local\Temp\9B6B.tmp"111⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\9BF8.tmp"C:\Users\Admin\AppData\Local\Temp\9BF8.tmp"112⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\9C94.tmp"C:\Users\Admin\AppData\Local\Temp\9C94.tmp"113⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\9D01.tmp"C:\Users\Admin\AppData\Local\Temp\9D01.tmp"114⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\9D7E.tmp"C:\Users\Admin\AppData\Local\Temp\9D7E.tmp"115⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\9E1B.tmp"C:\Users\Admin\AppData\Local\Temp\9E1B.tmp"116⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\9E98.tmp"C:\Users\Admin\AppData\Local\Temp\9E98.tmp"117⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\9F24.tmp"C:\Users\Admin\AppData\Local\Temp\9F24.tmp"118⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"C:\Users\Admin\AppData\Local\Temp\9FA1.tmp"119⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\A02E.tmp"C:\Users\Admin\AppData\Local\Temp\A02E.tmp"120⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\A0BB.tmp"C:\Users\Admin\AppData\Local\Temp\A0BB.tmp"121⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\A166.tmp"C:\Users\Admin\AppData\Local\Temp\A166.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:2460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-