Analysis
- max time kernel
110s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 03:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_161b94aae47924f7d034102e9356707f_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_161b94aae47924f7d034102e9356707f_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-03_161b94aae47924f7d034102e9356707f_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample260804-dxafcacc39
- SHA256 0a8ecce6c7e0b49067f6c21c766f68c5e0409a76a0f2d4e1b99eb7c77452e497
- MD5 161b94aae47924f7d034102e9356707f
- SHA1 8a3ceed9b98c660fb4559ba5ab8215d71c080adc
- SHA512 eb9e3429ae60090279d894ca6f7309c5a7c810ba6091ec50f00ea3074cb49ad01a4176407abd3cc994bf0a4b7ecfd76ddc473848d7799bb657e6ccdbd726ee44
- SSDEEP 12288:9U5rCOTei6sdoyx8+UDbDLUiSrqZoXWjdqpby1grA70G+o:9UQOJ6sdoyxkDbDLUdrqqGh4yATXo
- TLSH T181E40121B685C072F98612354EE6EBB1597EBC358B2265C77B80772E2E712E1D33530B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4904 4685.tmp 2796 4721.tmp 5988 47BD.tmp 5232 4879.tmp 5912 4905.tmp 4572 4A1F.tmp 5732 4BF3.tmp 4900 4CBF.tmp 5716 4DA9.tmp 4232 4E45.tmp 4660 4EE1.tmp 4112 4F7E.tmp 120 5039.tmp 4916 5104.tmp 1280 51CF.tmp 2068 528B.tmp 2952 5327.tmp 3564 5421.tmp 4444 54CD.tmp 5976 55C7.tmp 5704 5683.tmp 3164 573E.tmp 4044 57FA.tmp 1088 58B5.tmp 2356 5951.tmp 2084 59FD.tmp 1248 5AE8.tmp 2760 5BF1.tmp 2148 5CAD.tmp 4664 5D68.tmp 1560 5E14.tmp 1796 5EEF.tmp 5084 5F9B.tmp 3912 6037.tmp 5564 60C4.tmp 5744 6160.tmp 3696 61DD.tmp 2756 6269.tmp 1072 6315.tmp 4704 63A2.tmp 2268 643E.tmp 1824 64DA.tmp 828 6567.tmp 5660 65E4.tmp 4440 6661.tmp 1684 66EE.tmp 4940 677A.tmp 4320 6817.tmp 2832 6894.tmp 4148 6911.tmp 4364 69CC.tmp 4116 6A49.tmp 5820 6AB6.tmp 3728 6B43.tmp 1752 6BDF.tmp 1236 6C6C.tmp 4564 6CF9.tmp 5588 6D76.tmp 1840 6DE3.tmp 4932 6E7F.tmp 1144 6EFC.tmp 3084 6F6A.tmp 1120 6FE7.tmp 3400 7073.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 739B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D216.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2992.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8989.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9810.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A61A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E054.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 149.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3402.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A31C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5025.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 599B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 764A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6894.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 740D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 836F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C53A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 154E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9358.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1907.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 565F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E17D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E545.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 223F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6505.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C431.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A142.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C95C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D514.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92EF.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4428 wrote to memory of 4904 4428 2026-08-03_161b94aae47924f7d034102e9356707f_elex_mafia_stealc_tofsee.exe 89 PID 4904 wrote to memory of 2796 4904 4685.tmp 90 PID 2796 wrote to memory of 5988 2796 4721.tmp 91 PID 5988 wrote to memory of 5232 5988 47BD.tmp 92 PID 5232 wrote to memory of 5912 5232 4879.tmp 93 PID 5912 wrote to memory of 4572 5912 4905.tmp 94 PID 4572 wrote to memory of 5732 4572 4A1F.tmp 95 PID 5732 wrote to memory of 4900 5732 4BF3.tmp 96 PID 4900 wrote to memory of 5716 4900 4CBF.tmp 97 PID 5716 wrote to memory of 4232 5716 4DA9.tmp 98 PID 4232 wrote to memory of 4660 4232 4E45.tmp 99 PID 4660 wrote to memory of 4112 4660 4EE1.tmp 100 PID 4112 wrote to memory of 120 4112 4F7E.tmp 101 PID 120 wrote to memory of 4916 120 5039.tmp 102 PID 4916 wrote to memory of 1280 4916 5104.tmp 103 PID 1280 wrote to memory of 2068 1280 51CF.tmp 104 PID 2068 wrote to memory of 2952 2068 528B.tmp 105 PID 2952 wrote to memory of 3564 2952 5327.tmp 106 PID 3564 wrote to memory of 4444 3564 5421.tmp 107 PID 4444 wrote to memory of 5976 4444 54CD.tmp 108 PID 5976 wrote to memory of 5704 5976 55C7.tmp 109 PID 5704 wrote to memory of 3164 5704 5683.tmp 110 PID 3164 wrote to memory of 4044 3164 573E.tmp 111 PID 4044 wrote to memory of 1088 4044 57FA.tmp 112 PID 1088 wrote to memory of 2356 1088 58B5.tmp 113 PID 2356 wrote to memory of 2084 2356 5951.tmp 114 PID 2084 wrote to memory of 1248 2084 59FD.tmp 115 PID 1248 wrote to memory of 2760 1248 5AE8.tmp 116 PID 2760 wrote to memory of 2148 2760 5BF1.tmp 117 PID 2148 wrote to memory of 4664 2148 5CAD.tmp 118 PID 4664 wrote to memory of 1560 4664 5D68.tmp 119 PID 1560 wrote to memory of 1796 1560 5E14.tmp 120 PID 1796 wrote to memory of 5084 1796 5EEF.tmp 121 PID 5084 wrote to memory of 3912 5084 5F9B.tmp 122 PID 3912 wrote to memory of 5564 3912 6037.tmp 123 PID 5564 wrote to memory of 5744 5564 60C4.tmp 124 PID 5744 wrote to memory of 3696 5744 6160.tmp 125 PID 3696 wrote to memory of 2756 3696 61DD.tmp 126 PID 2756 wrote to memory of 1072 2756 6269.tmp 127 PID 1072 wrote to memory of 4704 1072 6315.tmp 128 PID 4704 wrote to memory of 2268 4704 63A2.tmp 129 PID 2268 wrote to memory of 1824 2268 643E.tmp 130 PID 1824 wrote to memory of 828 1824 64DA.tmp 131 PID 828 wrote to memory of 5660 828 6567.tmp 132 PID 5660 wrote to memory of 4440 5660 65E4.tmp 133 PID 4440 wrote to memory of 1684 4440 6661.tmp 134 PID 1684 wrote to memory of 4940 1684 66EE.tmp 135 PID 4940 wrote to memory of 4320 4940 677A.tmp 136 PID 4320 wrote to memory of 2832 4320 6817.tmp 137 PID 2832 wrote to memory of 4148 2832 6894.tmp 138 PID 4148 wrote to memory of 4364 4148 6911.tmp 139 PID 4364 wrote to memory of 4116 4364 69CC.tmp 140 PID 4116 wrote to memory of 5820 4116 6A49.tmp 141 PID 5820 wrote to memory of 3728 5820 6AB6.tmp 142 PID 3728 wrote to memory of 1752 3728 6B43.tmp 143 PID 1752 wrote to memory of 1236 1752 6BDF.tmp 144 PID 1236 wrote to memory of 4564 1236 6C6C.tmp 145 PID 4564 wrote to memory of 5588 4564 6CF9.tmp 146 PID 5588 wrote to memory of 1840 5588 6D76.tmp 147 PID 1840 wrote to memory of 4932 1840 6DE3.tmp 148 PID 4932 wrote to memory of 1144 4932 6E7F.tmp 149 PID 1144 wrote to memory of 3084 1144 6EFC.tmp 150 PID 3084 wrote to memory of 1120 3084 6F6A.tmp 151 PID 1120 wrote to memory of 3400 1120 6FE7.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_161b94aae47924f7d034102e9356707f_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_161b94aae47924f7d034102e9356707f_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\4685.tmp"C:\Users\Admin\AppData\Local\Temp\4685.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\4721.tmp"C:\Users\Admin\AppData\Local\Temp\4721.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\47BD.tmp"C:\Users\Admin\AppData\Local\Temp\47BD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\4879.tmp"C:\Users\Admin\AppData\Local\Temp\4879.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\4905.tmp"C:\Users\Admin\AppData\Local\Temp\4905.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\4A1F.tmp"C:\Users\Admin\AppData\Local\Temp\4A1F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\4BF3.tmp"C:\Users\Admin\AppData\Local\Temp\4BF3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"C:\Users\Admin\AppData\Local\Temp\4CBF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\4DA9.tmp"C:\Users\Admin\AppData\Local\Temp\4DA9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\4E45.tmp"C:\Users\Admin\AppData\Local\Temp\4E45.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\5039.tmp"C:\Users\Admin\AppData\Local\Temp\5039.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Users\Admin\AppData\Local\Temp\5104.tmp"C:\Users\Admin\AppData\Local\Temp\5104.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\51CF.tmp"C:\Users\Admin\AppData\Local\Temp\51CF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\528B.tmp"C:\Users\Admin\AppData\Local\Temp\528B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\5327.tmp"C:\Users\Admin\AppData\Local\Temp\5327.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\5421.tmp"C:\Users\Admin\AppData\Local\Temp\5421.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\54CD.tmp"C:\Users\Admin\AppData\Local\Temp\54CD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\55C7.tmp"C:\Users\Admin\AppData\Local\Temp\55C7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\5683.tmp"C:\Users\Admin\AppData\Local\Temp\5683.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\573E.tmp"C:\Users\Admin\AppData\Local\Temp\573E.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\57FA.tmp"C:\Users\Admin\AppData\Local\Temp\57FA.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\58B5.tmp"C:\Users\Admin\AppData\Local\Temp\58B5.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\5951.tmp"C:\Users\Admin\AppData\Local\Temp\5951.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\59FD.tmp"C:\Users\Admin\AppData\Local\Temp\59FD.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\5AE8.tmp"C:\Users\Admin\AppData\Local\Temp\5AE8.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\5BF1.tmp"C:\Users\Admin\AppData\Local\Temp\5BF1.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\5CAD.tmp"C:\Users\Admin\AppData\Local\Temp\5CAD.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\5D68.tmp"C:\Users\Admin\AppData\Local\Temp\5D68.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\5E14.tmp"C:\Users\Admin\AppData\Local\Temp\5E14.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\5EEF.tmp"C:\Users\Admin\AppData\Local\Temp\5EEF.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\5F9B.tmp"C:\Users\Admin\AppData\Local\Temp\5F9B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\6037.tmp"C:\Users\Admin\AppData\Local\Temp\6037.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\60C4.tmp"C:\Users\Admin\AppData\Local\Temp\60C4.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\6160.tmp"C:\Users\Admin\AppData\Local\Temp\6160.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\61DD.tmp"C:\Users\Admin\AppData\Local\Temp\61DD.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\6269.tmp"C:\Users\Admin\AppData\Local\Temp\6269.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\6315.tmp"C:\Users\Admin\AppData\Local\Temp\6315.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\63A2.tmp"C:\Users\Admin\AppData\Local\Temp\63A2.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\643E.tmp"C:\Users\Admin\AppData\Local\Temp\643E.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\64DA.tmp"C:\Users\Admin\AppData\Local\Temp\64DA.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\6567.tmp"C:\Users\Admin\AppData\Local\Temp\6567.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\65E4.tmp"C:\Users\Admin\AppData\Local\Temp\65E4.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\66EE.tmp"C:\Users\Admin\AppData\Local\Temp\66EE.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\677A.tmp"C:\Users\Admin\AppData\Local\Temp\677A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\6817.tmp"C:\Users\Admin\AppData\Local\Temp\6817.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\6894.tmp"C:\Users\Admin\AppData\Local\Temp\6894.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\6911.tmp"C:\Users\Admin\AppData\Local\Temp\6911.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\69CC.tmp"C:\Users\Admin\AppData\Local\Temp\69CC.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\6A49.tmp"C:\Users\Admin\AppData\Local\Temp\6A49.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\6AB6.tmp"C:\Users\Admin\AppData\Local\Temp\6AB6.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\6B43.tmp"C:\Users\Admin\AppData\Local\Temp\6B43.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\6BDF.tmp"C:\Users\Admin\AppData\Local\Temp\6BDF.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\6C6C.tmp"C:\Users\Admin\AppData\Local\Temp\6C6C.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\6CF9.tmp"C:\Users\Admin\AppData\Local\Temp\6CF9.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\6D76.tmp"C:\Users\Admin\AppData\Local\Temp\6D76.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\6DE3.tmp"C:\Users\Admin\AppData\Local\Temp\6DE3.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\6E7F.tmp"C:\Users\Admin\AppData\Local\Temp\6E7F.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\6EFC.tmp"C:\Users\Admin\AppData\Local\Temp\6EFC.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\6F6A.tmp"C:\Users\Admin\AppData\Local\Temp\6F6A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\6FE7.tmp"C:\Users\Admin\AppData\Local\Temp\6FE7.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\7073.tmp"C:\Users\Admin\AppData\Local\Temp\7073.tmp"65⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\70E1.tmp"C:\Users\Admin\AppData\Local\Temp\70E1.tmp"66⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\716D.tmp"C:\Users\Admin\AppData\Local\Temp\716D.tmp"67⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\71EA.tmp"C:\Users\Admin\AppData\Local\Temp\71EA.tmp"68⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\7267.tmp"C:\Users\Admin\AppData\Local\Temp\7267.tmp"69⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\72F4.tmp"C:\Users\Admin\AppData\Local\Temp\72F4.tmp"70⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\7380.tmp"C:\Users\Admin\AppData\Local\Temp\7380.tmp"71⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\740D.tmp"C:\Users\Admin\AppData\Local\Temp\740D.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\749A.tmp"C:\Users\Admin\AppData\Local\Temp\749A.tmp"73⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\7526.tmp"C:\Users\Admin\AppData\Local\Temp\7526.tmp"74⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\75A3.tmp"C:\Users\Admin\AppData\Local\Temp\75A3.tmp"75⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\7640.tmp"C:\Users\Admin\AppData\Local\Temp\7640.tmp"76⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\76CC.tmp"C:\Users\Admin\AppData\Local\Temp\76CC.tmp"77⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\773A.tmp"C:\Users\Admin\AppData\Local\Temp\773A.tmp"78⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\77A7.tmp"C:\Users\Admin\AppData\Local\Temp\77A7.tmp"79⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\7834.tmp"C:\Users\Admin\AppData\Local\Temp\7834.tmp"80⤵PID:5212
-
C:\Users\Admin\AppData\Local\Temp\78C0.tmp"C:\Users\Admin\AppData\Local\Temp\78C0.tmp"81⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\794D.tmp"C:\Users\Admin\AppData\Local\Temp\794D.tmp"82⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\79D9.tmp"C:\Users\Admin\AppData\Local\Temp\79D9.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\7A85.tmp"C:\Users\Admin\AppData\Local\Temp\7A85.tmp"84⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\7B12.tmp"C:\Users\Admin\AppData\Local\Temp\7B12.tmp"85⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\7BBE.tmp"C:\Users\Admin\AppData\Local\Temp\7BBE.tmp"86⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\7C4A.tmp"C:\Users\Admin\AppData\Local\Temp\7C4A.tmp"87⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\7CC7.tmp"C:\Users\Admin\AppData\Local\Temp\7CC7.tmp"88⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\7D44.tmp"C:\Users\Admin\AppData\Local\Temp\7D44.tmp"89⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"90⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\7E3E.tmp"C:\Users\Admin\AppData\Local\Temp\7E3E.tmp"91⤵PID:5936
-
C:\Users\Admin\AppData\Local\Temp\7EDB.tmp"C:\Users\Admin\AppData\Local\Temp\7EDB.tmp"92⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\7F67.tmp"C:\Users\Admin\AppData\Local\Temp\7F67.tmp"93⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"94⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\8081.tmp"C:\Users\Admin\AppData\Local\Temp\8081.tmp"95⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\80FE.tmp"C:\Users\Admin\AppData\Local\Temp\80FE.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\817B.tmp"C:\Users\Admin\AppData\Local\Temp\817B.tmp"97⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\81F8.tmp"C:\Users\Admin\AppData\Local\Temp\81F8.tmp"98⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\8265.tmp"C:\Users\Admin\AppData\Local\Temp\8265.tmp"99⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\82F2.tmp"C:\Users\Admin\AppData\Local\Temp\82F2.tmp"100⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\836F.tmp"C:\Users\Admin\AppData\Local\Temp\836F.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\83EC.tmp"C:\Users\Admin\AppData\Local\Temp\83EC.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:568 -
C:\Users\Admin\AppData\Local\Temp\8478.tmp"C:\Users\Admin\AppData\Local\Temp\8478.tmp"103⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\8505.tmp"C:\Users\Admin\AppData\Local\Temp\8505.tmp"104⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\85A1.tmp"C:\Users\Admin\AppData\Local\Temp\85A1.tmp"105⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\864D.tmp"C:\Users\Admin\AppData\Local\Temp\864D.tmp"106⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\86BA.tmp"C:\Users\Admin\AppData\Local\Temp\86BA.tmp"107⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\8747.tmp"C:\Users\Admin\AppData\Local\Temp\8747.tmp"108⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\87B4.tmp"C:\Users\Admin\AppData\Local\Temp\87B4.tmp"109⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\8822.tmp"C:\Users\Admin\AppData\Local\Temp\8822.tmp"110⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\889F.tmp"C:\Users\Admin\AppData\Local\Temp\889F.tmp"111⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\890C.tmp"C:\Users\Admin\AppData\Local\Temp\890C.tmp"112⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\8989.tmp"C:\Users\Admin\AppData\Local\Temp\8989.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\8A16.tmp"C:\Users\Admin\AppData\Local\Temp\8A16.tmp"114⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\8A93.tmp"C:\Users\Admin\AppData\Local\Temp\8A93.tmp"115⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\8B1F.tmp"C:\Users\Admin\AppData\Local\Temp\8B1F.tmp"116⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"117⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\8C48.tmp"C:\Users\Admin\AppData\Local\Temp\8C48.tmp"118⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"119⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\8D52.tmp"C:\Users\Admin\AppData\Local\Temp\8D52.tmp"120⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"C:\Users\Admin\AppData\Local\Temp\8DDE.tmp"121⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"122⤵PID:3660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-