Analysis
- max time kernel
127s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 07:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_2b67c5c2719c1627980caab8c355000c_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_2b67c5c2719c1627980caab8c355000c_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-04_2b67c5c2719c1627980caab8c355000c_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260804-jsa4zaztev
- SHA256 3dd1e01f41df4475749f1ee0382e0f583fedbdf9b4826f138c1be992cff667bd
- MD5 2b67c5c2719c1627980caab8c355000c
- SHA1 1c1fdfc42944c36ef0ca581ac18d7f4e82c8def8
- SHA512 208f7211a9fa583ff3b92524e43f7c79cff33cf7c7673dd354523656801fd2cf94bb70291ce8fb077ab98078334234f718544ced43f2b059ad458c8df33db151
- SSDEEP 12288:NU5rCOTeijt29c7k7YLOJjDEXOTZwlH4Hp:NUQOJjt2lGOJjoXOTSlH4Hp
- TLSH T1DCB4F125B685C533E69202724AD6DBB16E3B7D345326A0C33B90663E2FB16E1D376307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3644 7B50.tmp 5500 7CA8.tmp 4084 7D73.tmp 5624 7E1F.tmp 5060 7F19.tmp 3904 8004.tmp 4952 80BF.tmp 2012 814C.tmp 5412 8217.tmp 3160 82C3.tmp 5092 83BD.tmp 3064 84B7.tmp 1140 8553.tmp 5320 860E.tmp 3080 86F9.tmp 4892 87D4.tmp 5996 888F.tmp 3636 894B.tmp 5516 8A54.tmp 2140 8B3F.tmp 2752 8BDB.tmp 1656 8C87.tmp 5416 8D23.tmp 1076 8DCF.tmp 5708 8EC9.tmp 3964 8F75.tmp 5900 905F.tmp 3880 912A.tmp 5032 91E6.tmp 4288 92E0.tmp 1876 93AB.tmp 4488 9437.tmp 3228 94D4.tmp 1624 9570.tmp 548 95DD.tmp 4852 965A.tmp 2368 96E7.tmp 3300 9764.tmp 1120 97E1.tmp 696 986E.tmp 900 9939.tmp 5020 99B6.tmp 2872 9A42.tmp 2084 9AFE.tmp 5384 9B9A.tmp 1756 9C27.tmp 792 9CA4.tmp 4108 9D30.tmp 1152 9DCD.tmp 4796 9E78.tmp 4664 9EE6.tmp 1848 9F53.tmp 4516 9FD0.tmp 3152 A04D.tmp 3536 A0DA.tmp 1260 A157.tmp 1620 A1D4.tmp 920 A241.tmp 4172 A2CE.tmp 5924 A33B.tmp 2844 A3B8.tmp 3052 A454.tmp 4856 A4F1.tmp 3424 A58D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7408.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1123.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 171E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2404.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 570A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B53D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7570.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 925E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 100A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 519C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D17A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1956.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_2b67c5c2719c1627980caab8c355000c_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D68B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 721.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1384.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 613C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 760C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C380.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F543.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 977.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D289.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 880D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9125.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 370F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E40D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E560.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F128.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1796 wrote to memory of 3644 1796 2026-08-04_2b67c5c2719c1627980caab8c355000c_elex_mafia_stealc_tofsee.exe 89 PID 3644 wrote to memory of 5500 3644 7B50.tmp 90 PID 5500 wrote to memory of 4084 5500 7CA8.tmp 91 PID 4084 wrote to memory of 5624 4084 7D73.tmp 92 PID 5624 wrote to memory of 5060 5624 7E1F.tmp 93 PID 5060 wrote to memory of 3904 5060 7F19.tmp 94 PID 3904 wrote to memory of 4952 3904 8004.tmp 95 PID 4952 wrote to memory of 2012 4952 80BF.tmp 96 PID 2012 wrote to memory of 5412 2012 814C.tmp 97 PID 5412 wrote to memory of 3160 5412 8217.tmp 98 PID 3160 wrote to memory of 5092 3160 82C3.tmp 99 PID 5092 wrote to memory of 3064 5092 83BD.tmp 100 PID 3064 wrote to memory of 1140 3064 84B7.tmp 101 PID 1140 wrote to memory of 5320 1140 8553.tmp 102 PID 5320 wrote to memory of 3080 5320 860E.tmp 103 PID 3080 wrote to memory of 4892 3080 86F9.tmp 104 PID 4892 wrote to memory of 5996 4892 87D4.tmp 105 PID 5996 wrote to memory of 3636 5996 888F.tmp 106 PID 3636 wrote to memory of 5516 3636 894B.tmp 107 PID 5516 wrote to memory of 2140 5516 8A54.tmp 108 PID 2140 wrote to memory of 2752 2140 8B3F.tmp 109 PID 2752 wrote to memory of 1656 2752 8BDB.tmp 110 PID 1656 wrote to memory of 5416 1656 8C87.tmp 111 PID 5416 wrote to memory of 1076 5416 8D23.tmp 112 PID 1076 wrote to memory of 5708 1076 8DCF.tmp 113 PID 5708 wrote to memory of 3964 5708 8EC9.tmp 114 PID 3964 wrote to memory of 5900 3964 8F75.tmp 115 PID 5900 wrote to memory of 3880 5900 905F.tmp 116 PID 3880 wrote to memory of 5032 3880 912A.tmp 117 PID 5032 wrote to memory of 4288 5032 91E6.tmp 118 PID 4288 wrote to memory of 1876 4288 92E0.tmp 119 PID 1876 wrote to memory of 4488 1876 93AB.tmp 120 PID 4488 wrote to memory of 3228 4488 9437.tmp 121 PID 3228 wrote to memory of 1624 3228 94D4.tmp 122 PID 1624 wrote to memory of 548 1624 9570.tmp 123 PID 548 wrote to memory of 4852 548 95DD.tmp 124 PID 4852 wrote to memory of 2368 4852 965A.tmp 125 PID 2368 wrote to memory of 3300 2368 96E7.tmp 126 PID 3300 wrote to memory of 1120 3300 9764.tmp 127 PID 1120 wrote to memory of 696 1120 97E1.tmp 128 PID 696 wrote to memory of 900 696 986E.tmp 129 PID 900 wrote to memory of 5020 900 9939.tmp 130 PID 5020 wrote to memory of 2872 5020 99B6.tmp 131 PID 2872 wrote to memory of 2084 2872 9A42.tmp 132 PID 2084 wrote to memory of 5384 2084 9AFE.tmp 133 PID 5384 wrote to memory of 1756 5384 9B9A.tmp 134 PID 1756 wrote to memory of 792 1756 9C27.tmp 135 PID 792 wrote to memory of 4108 792 9CA4.tmp 136 PID 4108 wrote to memory of 1152 4108 9D30.tmp 137 PID 1152 wrote to memory of 4796 1152 9DCD.tmp 138 PID 4796 wrote to memory of 4664 4796 9E78.tmp 139 PID 4664 wrote to memory of 1848 4664 9EE6.tmp 140 PID 1848 wrote to memory of 4516 1848 9F53.tmp 141 PID 4516 wrote to memory of 3152 4516 9FD0.tmp 142 PID 3152 wrote to memory of 3536 3152 A04D.tmp 143 PID 3536 wrote to memory of 1260 3536 A0DA.tmp 144 PID 1260 wrote to memory of 1620 1260 A157.tmp 145 PID 1620 wrote to memory of 920 1620 A1D4.tmp 146 PID 920 wrote to memory of 4172 920 A241.tmp 147 PID 4172 wrote to memory of 5924 4172 A2CE.tmp 148 PID 5924 wrote to memory of 2844 5924 A33B.tmp 149 PID 2844 wrote to memory of 3052 2844 A3B8.tmp 150 PID 3052 wrote to memory of 4856 3052 A454.tmp 151 PID 4856 wrote to memory of 3424 4856 A4F1.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_2b67c5c2719c1627980caab8c355000c_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_2b67c5c2719c1627980caab8c355000c_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\7B50.tmp"C:\Users\Admin\AppData\Local\Temp\7B50.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"C:\Users\Admin\AppData\Local\Temp\7CA8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\7D73.tmp"C:\Users\Admin\AppData\Local\Temp\7D73.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\7E1F.tmp"C:\Users\Admin\AppData\Local\Temp\7E1F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\7F19.tmp"C:\Users\Admin\AppData\Local\Temp\7F19.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\8004.tmp"C:\Users\Admin\AppData\Local\Temp\8004.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\80BF.tmp"C:\Users\Admin\AppData\Local\Temp\80BF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\814C.tmp"C:\Users\Admin\AppData\Local\Temp\814C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\8217.tmp"C:\Users\Admin\AppData\Local\Temp\8217.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\82C3.tmp"C:\Users\Admin\AppData\Local\Temp\82C3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\83BD.tmp"C:\Users\Admin\AppData\Local\Temp\83BD.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\84B7.tmp"C:\Users\Admin\AppData\Local\Temp\84B7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\8553.tmp"C:\Users\Admin\AppData\Local\Temp\8553.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\860E.tmp"C:\Users\Admin\AppData\Local\Temp\860E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\86F9.tmp"C:\Users\Admin\AppData\Local\Temp\86F9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\87D4.tmp"C:\Users\Admin\AppData\Local\Temp\87D4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\888F.tmp"C:\Users\Admin\AppData\Local\Temp\888F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\894B.tmp"C:\Users\Admin\AppData\Local\Temp\894B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\8A54.tmp"C:\Users\Admin\AppData\Local\Temp\8A54.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\8EC9.tmp"C:\Users\Admin\AppData\Local\Temp\8EC9.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\8F75.tmp"C:\Users\Admin\AppData\Local\Temp\8F75.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\905F.tmp"C:\Users\Admin\AppData\Local\Temp\905F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\912A.tmp"C:\Users\Admin\AppData\Local\Temp\912A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\91E6.tmp"C:\Users\Admin\AppData\Local\Temp\91E6.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\92E0.tmp"C:\Users\Admin\AppData\Local\Temp\92E0.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\93AB.tmp"C:\Users\Admin\AppData\Local\Temp\93AB.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\9437.tmp"C:\Users\Admin\AppData\Local\Temp\9437.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\94D4.tmp"C:\Users\Admin\AppData\Local\Temp\94D4.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\9570.tmp"C:\Users\Admin\AppData\Local\Temp\9570.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\95DD.tmp"C:\Users\Admin\AppData\Local\Temp\95DD.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\965A.tmp"C:\Users\Admin\AppData\Local\Temp\965A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\96E7.tmp"C:\Users\Admin\AppData\Local\Temp\96E7.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\9764.tmp"C:\Users\Admin\AppData\Local\Temp\9764.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\97E1.tmp"C:\Users\Admin\AppData\Local\Temp\97E1.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\986E.tmp"C:\Users\Admin\AppData\Local\Temp\986E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\9939.tmp"C:\Users\Admin\AppData\Local\Temp\9939.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\99B6.tmp"C:\Users\Admin\AppData\Local\Temp\99B6.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\9A42.tmp"C:\Users\Admin\AppData\Local\Temp\9A42.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\9AFE.tmp"C:\Users\Admin\AppData\Local\Temp\9AFE.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\9B9A.tmp"C:\Users\Admin\AppData\Local\Temp\9B9A.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\9C27.tmp"C:\Users\Admin\AppData\Local\Temp\9C27.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"C:\Users\Admin\AppData\Local\Temp\9CA4.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\9D30.tmp"C:\Users\Admin\AppData\Local\Temp\9D30.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\9DCD.tmp"C:\Users\Admin\AppData\Local\Temp\9DCD.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\9E78.tmp"C:\Users\Admin\AppData\Local\Temp\9E78.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"C:\Users\Admin\AppData\Local\Temp\9EE6.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\9F53.tmp"C:\Users\Admin\AppData\Local\Temp\9F53.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\9FD0.tmp"C:\Users\Admin\AppData\Local\Temp\9FD0.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\A04D.tmp"C:\Users\Admin\AppData\Local\Temp\A04D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\A0DA.tmp"C:\Users\Admin\AppData\Local\Temp\A0DA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\A157.tmp"C:\Users\Admin\AppData\Local\Temp\A157.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\A1D4.tmp"C:\Users\Admin\AppData\Local\Temp\A1D4.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\A241.tmp"C:\Users\Admin\AppData\Local\Temp\A241.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\A2CE.tmp"C:\Users\Admin\AppData\Local\Temp\A2CE.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\A33B.tmp"C:\Users\Admin\AppData\Local\Temp\A33B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"C:\Users\Admin\AppData\Local\Temp\A3B8.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\A454.tmp"C:\Users\Admin\AppData\Local\Temp\A454.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\A4F1.tmp"C:\Users\Admin\AppData\Local\Temp\A4F1.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\A58D.tmp"C:\Users\Admin\AppData\Local\Temp\A58D.tmp"65⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"C:\Users\Admin\AppData\Local\Temp\A5FA.tmp"66⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\A677.tmp"C:\Users\Admin\AppData\Local\Temp\A677.tmp"67⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\A704.tmp"C:\Users\Admin\AppData\Local\Temp\A704.tmp"68⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\A781.tmp"C:\Users\Admin\AppData\Local\Temp\A781.tmp"69⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\A7FE.tmp"C:\Users\Admin\AppData\Local\Temp\A7FE.tmp"70⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\A88B.tmp"C:\Users\Admin\AppData\Local\Temp\A88B.tmp"71⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"C:\Users\Admin\AppData\Local\Temp\A8F8.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\A994.tmp"C:\Users\Admin\AppData\Local\Temp\A994.tmp"73⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\AA21.tmp"C:\Users\Admin\AppData\Local\Temp\AA21.tmp"74⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\AAAD.tmp"C:\Users\Admin\AppData\Local\Temp\AAAD.tmp"75⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\AB1B.tmp"C:\Users\Admin\AppData\Local\Temp\AB1B.tmp"76⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"C:\Users\Admin\AppData\Local\Temp\ABA7.tmp"77⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\AC24.tmp"C:\Users\Admin\AppData\Local\Temp\AC24.tmp"78⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\ACB1.tmp"C:\Users\Admin\AppData\Local\Temp\ACB1.tmp"79⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\AD2E.tmp"C:\Users\Admin\AppData\Local\Temp\AD2E.tmp"80⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"81⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\AE28.tmp"C:\Users\Admin\AppData\Local\Temp\AE28.tmp"82⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\AEB5.tmp"C:\Users\Admin\AppData\Local\Temp\AEB5.tmp"83⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\AF32.tmp"C:\Users\Admin\AppData\Local\Temp\AF32.tmp"84⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\AFBE.tmp"C:\Users\Admin\AppData\Local\Temp\AFBE.tmp"85⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\B06A.tmp"C:\Users\Admin\AppData\Local\Temp\B06A.tmp"86⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"87⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\B164.tmp"C:\Users\Admin\AppData\Local\Temp\B164.tmp"88⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"89⤵PID:5424
-
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"90⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"91⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\B397.tmp"C:\Users\Admin\AppData\Local\Temp\B397.tmp"92⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\B423.tmp"C:\Users\Admin\AppData\Local\Temp\B423.tmp"93⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"C:\Users\Admin\AppData\Local\Temp\B4A0.tmp"94⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\B53D.tmp"C:\Users\Admin\AppData\Local\Temp\B53D.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"96⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\B646.tmp"C:\Users\Admin\AppData\Local\Temp\B646.tmp"97⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\B6C3.tmp"C:\Users\Admin\AppData\Local\Temp\B6C3.tmp"98⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\B740.tmp"C:\Users\Admin\AppData\Local\Temp\B740.tmp"99⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\B7DC.tmp"C:\Users\Admin\AppData\Local\Temp\B7DC.tmp"100⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\B869.tmp"C:\Users\Admin\AppData\Local\Temp\B869.tmp"101⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\B8E6.tmp"C:\Users\Admin\AppData\Local\Temp\B8E6.tmp"102⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\B953.tmp"C:\Users\Admin\AppData\Local\Temp\B953.tmp"103⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"C:\Users\Admin\AppData\Local\Temp\B9D0.tmp"104⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\BA5D.tmp"C:\Users\Admin\AppData\Local\Temp\BA5D.tmp"105⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"C:\Users\Admin\AppData\Local\Temp\BAEA.tmp"106⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\BB57.tmp"C:\Users\Admin\AppData\Local\Temp\BB57.tmp"107⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\BBF3.tmp"C:\Users\Admin\AppData\Local\Temp\BBF3.tmp"108⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\BC70.tmp"C:\Users\Admin\AppData\Local\Temp\BC70.tmp"109⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\BCED.tmp"C:\Users\Admin\AppData\Local\Temp\BCED.tmp"110⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\BD7A.tmp"C:\Users\Admin\AppData\Local\Temp\BD7A.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\BDE7.tmp"C:\Users\Admin\AppData\Local\Temp\BDE7.tmp"112⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\BE64.tmp"C:\Users\Admin\AppData\Local\Temp\BE64.tmp"113⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"C:\Users\Admin\AppData\Local\Temp\BEE1.tmp"114⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\BFDB.tmp"C:\Users\Admin\AppData\Local\Temp\BFDB.tmp"116⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\C049.tmp"C:\Users\Admin\AppData\Local\Temp\C049.tmp"117⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"118⤵PID:5248
-
C:\Users\Admin\AppData\Local\Temp\C152.tmp"C:\Users\Admin\AppData\Local\Temp\C152.tmp"119⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\C1CF.tmp"C:\Users\Admin\AppData\Local\Temp\C1CF.tmp"120⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\C24C.tmp"C:\Users\Admin\AppData\Local\Temp\C24C.tmp"121⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"C:\Users\Admin\AppData\Local\Temp\C2C9.tmp"122⤵PID:2080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-