Analysis
- max time kernel
112s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 00:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_4f25a569b048579b3bd993a2418f9511_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_4f25a569b048579b3bd993a2418f9511_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-05_4f25a569b048579b3bd993a2418f9511_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260806-anp8navvbv
- SHA256 83146defe8108bfa905fdbc5e2010d863d5f3660c05c6ea67d6ee19b2e06d09c
- MD5 4f25a569b048579b3bd993a2418f9511
- SHA1 071ac2cc67d977dbf5a351a6c1c4e7ae4f5a5652
- SHA512 d697a07c1e145a03256602376e91795927acc1ff8813a62b2aa4c4ef1899bbe0357b3a8a93f7248e00c8ed2b755f97d0907c9031ccbfa9853940f96bc4b716aa
- SSDEEP 12288:9U5rCOTei6X041lAm3ceZOLvC2RzSCVHQwqZoXWjdq:9UQOJ6X041hhZOLQwqqGh
- TLSH T155C4F121B545C032E99202314EE6EBB1692EBC355B26A4C77BC0B76E6FB52E0D374347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5216 1FA4.tmp 4900 2030.tmp 5004 20AD.tmp 1396 211B.tmp 4112 21D6.tmp 2208 22A1.tmp 1564 231E.tmp 1228 239B.tmp 5232 2438.tmp 3412 24C4.tmp 2624 2541.tmp 4752 25BE.tmp 4716 267A.tmp 5636 2754.tmp 2744 27F1.tmp 2920 286E.tmp 5840 28FA.tmp 3328 29E5.tmp 3352 2A52.tmp 5928 2AEE.tmp 5124 2BE8.tmp 4232 2CA4.tmp 1780 2D40.tmp 5416 2E1B.tmp 5448 2EB7.tmp 4420 2F92.tmp 1360 301E.tmp 1916 30EA.tmp 3752 31B5.tmp 4772 3261.tmp 1892 330C.tmp 2712 3399.tmp 860 3435.tmp 5252 34B2.tmp 4212 3520.tmp 3972 357D.tmp 6016 35EB.tmp 4352 3658.tmp 4860 36C6.tmp 612 3733.tmp 5640 37A0.tmp 3388 380E.tmp 4692 387B.tmp 4192 38E8.tmp 4680 3956.tmp 4720 39C3.tmp 6136 3A40.tmp 2884 3AAE.tmp 2840 3B1B.tmp 2228 3B88.tmp 2608 3BF6.tmp 5236 3C63.tmp 4344 3CD0.tmp 4200 3D3E.tmp 4364 3DAB.tmp 3864 3E19.tmp 4140 3E86.tmp 1020 3EF3.tmp 2616 3F61.tmp 2756 3FCE.tmp 5772 404B.tmp 6092 40B8.tmp 5816 4126.tmp 4292 41E1.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9699.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 207A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_4f25a569b048579b3bd993a2418f9511_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 550C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B29D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 357D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 766E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5332.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5526.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C48E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 380E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B368.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3579.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 107C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 690C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9735.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A927.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A166.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B586.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97E1.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3804 wrote to memory of 5216 3804 2026-08-05_4f25a569b048579b3bd993a2418f9511_elex_mafia_stealc_tofsee.exe 89 PID 5216 wrote to memory of 4900 5216 1FA4.tmp 90 PID 4900 wrote to memory of 5004 4900 2030.tmp 91 PID 5004 wrote to memory of 1396 5004 20AD.tmp 92 PID 1396 wrote to memory of 4112 1396 211B.tmp 93 PID 4112 wrote to memory of 2208 4112 21D6.tmp 94 PID 2208 wrote to memory of 1564 2208 22A1.tmp 95 PID 1564 wrote to memory of 1228 1564 231E.tmp 96 PID 1228 wrote to memory of 5232 1228 239B.tmp 97 PID 5232 wrote to memory of 3412 5232 2438.tmp 98 PID 3412 wrote to memory of 2624 3412 24C4.tmp 99 PID 2624 wrote to memory of 4752 2624 2541.tmp 100 PID 4752 wrote to memory of 4716 4752 25BE.tmp 101 PID 4716 wrote to memory of 5636 4716 267A.tmp 102 PID 5636 wrote to memory of 2744 5636 2754.tmp 103 PID 2744 wrote to memory of 2920 2744 27F1.tmp 104 PID 2920 wrote to memory of 5840 2920 286E.tmp 105 PID 5840 wrote to memory of 3328 5840 28FA.tmp 106 PID 3328 wrote to memory of 3352 3328 29E5.tmp 107 PID 3352 wrote to memory of 5928 3352 2A52.tmp 108 PID 5928 wrote to memory of 5124 5928 2AEE.tmp 109 PID 5124 wrote to memory of 4232 5124 2BE8.tmp 110 PID 4232 wrote to memory of 1780 4232 2CA4.tmp 111 PID 1780 wrote to memory of 5416 1780 2D40.tmp 112 PID 5416 wrote to memory of 5448 5416 2E1B.tmp 113 PID 5448 wrote to memory of 4420 5448 2EB7.tmp 114 PID 4420 wrote to memory of 1360 4420 2F92.tmp 115 PID 1360 wrote to memory of 1916 1360 301E.tmp 116 PID 1916 wrote to memory of 3752 1916 30EA.tmp 117 PID 3752 wrote to memory of 4772 3752 31B5.tmp 118 PID 4772 wrote to memory of 1892 4772 3261.tmp 119 PID 1892 wrote to memory of 2712 1892 330C.tmp 120 PID 2712 wrote to memory of 860 2712 3399.tmp 121 PID 860 wrote to memory of 5252 860 3435.tmp 122 PID 5252 wrote to memory of 4212 5252 34B2.tmp 123 PID 4212 wrote to memory of 3972 4212 3520.tmp 124 PID 3972 wrote to memory of 6016 3972 357D.tmp 125 PID 6016 wrote to memory of 4352 6016 35EB.tmp 126 PID 4352 wrote to memory of 4860 4352 3658.tmp 127 PID 4860 wrote to memory of 612 4860 36C6.tmp 128 PID 612 wrote to memory of 5640 612 3733.tmp 129 PID 5640 wrote to memory of 3388 5640 37A0.tmp 130 PID 3388 wrote to memory of 4692 3388 380E.tmp 131 PID 4692 wrote to memory of 4192 4692 387B.tmp 132 PID 4192 wrote to memory of 4680 4192 38E8.tmp 133 PID 4680 wrote to memory of 4720 4680 3956.tmp 134 PID 4720 wrote to memory of 6136 4720 39C3.tmp 135 PID 6136 wrote to memory of 2884 6136 3A40.tmp 136 PID 2884 wrote to memory of 2840 2884 3AAE.tmp 137 PID 2840 wrote to memory of 2228 2840 3B1B.tmp 138 PID 2228 wrote to memory of 2608 2228 3B88.tmp 139 PID 2608 wrote to memory of 5236 2608 3BF6.tmp 140 PID 5236 wrote to memory of 4344 5236 3C63.tmp 141 PID 4344 wrote to memory of 4200 4344 3CD0.tmp 142 PID 4200 wrote to memory of 4364 4200 3D3E.tmp 143 PID 4364 wrote to memory of 3864 4364 3DAB.tmp 144 PID 3864 wrote to memory of 4140 3864 3E19.tmp 145 PID 4140 wrote to memory of 1020 4140 3E86.tmp 146 PID 1020 wrote to memory of 2616 1020 3EF3.tmp 147 PID 2616 wrote to memory of 2756 2616 3F61.tmp 148 PID 2756 wrote to memory of 5772 2756 3FCE.tmp 149 PID 5772 wrote to memory of 6092 5772 404B.tmp 150 PID 6092 wrote to memory of 5816 6092 40B8.tmp 151 PID 5816 wrote to memory of 4292 5816 4126.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_4f25a569b048579b3bd993a2418f9511_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_4f25a569b048579b3bd993a2418f9511_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\1FA4.tmp"C:\Users\Admin\AppData\Local\Temp\1FA4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\2030.tmp"C:\Users\Admin\AppData\Local\Temp\2030.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\20AD.tmp"C:\Users\Admin\AppData\Local\Temp\20AD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\211B.tmp"C:\Users\Admin\AppData\Local\Temp\211B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\21D6.tmp"C:\Users\Admin\AppData\Local\Temp\21D6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\22A1.tmp"C:\Users\Admin\AppData\Local\Temp\22A1.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\231E.tmp"C:\Users\Admin\AppData\Local\Temp\231E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\239B.tmp"C:\Users\Admin\AppData\Local\Temp\239B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\2438.tmp"C:\Users\Admin\AppData\Local\Temp\2438.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Users\Admin\AppData\Local\Temp\24C4.tmp"C:\Users\Admin\AppData\Local\Temp\24C4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\2541.tmp"C:\Users\Admin\AppData\Local\Temp\2541.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\25BE.tmp"C:\Users\Admin\AppData\Local\Temp\25BE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\267A.tmp"C:\Users\Admin\AppData\Local\Temp\267A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\2754.tmp"C:\Users\Admin\AppData\Local\Temp\2754.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\27F1.tmp"C:\Users\Admin\AppData\Local\Temp\27F1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\286E.tmp"C:\Users\Admin\AppData\Local\Temp\286E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\28FA.tmp"C:\Users\Admin\AppData\Local\Temp\28FA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\29E5.tmp"C:\Users\Admin\AppData\Local\Temp\29E5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\2A52.tmp"C:\Users\Admin\AppData\Local\Temp\2A52.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\2AEE.tmp"C:\Users\Admin\AppData\Local\Temp\2AEE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\2BE8.tmp"C:\Users\Admin\AppData\Local\Temp\2BE8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\2CA4.tmp"C:\Users\Admin\AppData\Local\Temp\2CA4.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\2D40.tmp"C:\Users\Admin\AppData\Local\Temp\2D40.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\2F92.tmp"C:\Users\Admin\AppData\Local\Temp\2F92.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\301E.tmp"C:\Users\Admin\AppData\Local\Temp\301E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\30EA.tmp"C:\Users\Admin\AppData\Local\Temp\30EA.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\31B5.tmp"C:\Users\Admin\AppData\Local\Temp\31B5.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\3261.tmp"C:\Users\Admin\AppData\Local\Temp\3261.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\330C.tmp"C:\Users\Admin\AppData\Local\Temp\330C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\3399.tmp"C:\Users\Admin\AppData\Local\Temp\3399.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\3435.tmp"C:\Users\Admin\AppData\Local\Temp\3435.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\34B2.tmp"C:\Users\Admin\AppData\Local\Temp\34B2.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\3520.tmp"C:\Users\Admin\AppData\Local\Temp\3520.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\357D.tmp"C:\Users\Admin\AppData\Local\Temp\357D.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\35EB.tmp"C:\Users\Admin\AppData\Local\Temp\35EB.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\3658.tmp"C:\Users\Admin\AppData\Local\Temp\3658.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\36C6.tmp"C:\Users\Admin\AppData\Local\Temp\36C6.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\3733.tmp"C:\Users\Admin\AppData\Local\Temp\3733.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Local\Temp\37A0.tmp"C:\Users\Admin\AppData\Local\Temp\37A0.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\380E.tmp"C:\Users\Admin\AppData\Local\Temp\380E.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\387B.tmp"C:\Users\Admin\AppData\Local\Temp\387B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\38E8.tmp"C:\Users\Admin\AppData\Local\Temp\38E8.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\3956.tmp"C:\Users\Admin\AppData\Local\Temp\3956.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\39C3.tmp"C:\Users\Admin\AppData\Local\Temp\39C3.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\3A40.tmp"C:\Users\Admin\AppData\Local\Temp\3A40.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\3B88.tmp"C:\Users\Admin\AppData\Local\Temp\3B88.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\3BF6.tmp"C:\Users\Admin\AppData\Local\Temp\3BF6.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\3C63.tmp"C:\Users\Admin\AppData\Local\Temp\3C63.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\3CD0.tmp"C:\Users\Admin\AppData\Local\Temp\3CD0.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\3D3E.tmp"C:\Users\Admin\AppData\Local\Temp\3D3E.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\3DAB.tmp"C:\Users\Admin\AppData\Local\Temp\3DAB.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\3EF3.tmp"C:\Users\Admin\AppData\Local\Temp\3EF3.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Users\Admin\AppData\Local\Temp\40B8.tmp"C:\Users\Admin\AppData\Local\Temp\40B8.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\4126.tmp"C:\Users\Admin\AppData\Local\Temp\4126.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\41E1.tmp"C:\Users\Admin\AppData\Local\Temp\41E1.tmp"65⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\423F.tmp"C:\Users\Admin\AppData\Local\Temp\423F.tmp"66⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\42AC.tmp"C:\Users\Admin\AppData\Local\Temp\42AC.tmp"67⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\431A.tmp"C:\Users\Admin\AppData\Local\Temp\431A.tmp"68⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\4387.tmp"C:\Users\Admin\AppData\Local\Temp\4387.tmp"69⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\4404.tmp"C:\Users\Admin\AppData\Local\Temp\4404.tmp"70⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\4472.tmp"C:\Users\Admin\AppData\Local\Temp\4472.tmp"71⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\44DF.tmp"C:\Users\Admin\AppData\Local\Temp\44DF.tmp"72⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\454C.tmp"C:\Users\Admin\AppData\Local\Temp\454C.tmp"73⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\45BA.tmp"C:\Users\Admin\AppData\Local\Temp\45BA.tmp"74⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\4627.tmp"C:\Users\Admin\AppData\Local\Temp\4627.tmp"75⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\4694.tmp"C:\Users\Admin\AppData\Local\Temp\4694.tmp"76⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\4702.tmp"C:\Users\Admin\AppData\Local\Temp\4702.tmp"77⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\476F.tmp"C:\Users\Admin\AppData\Local\Temp\476F.tmp"78⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\47DD.tmp"C:\Users\Admin\AppData\Local\Temp\47DD.tmp"79⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\484A.tmp"C:\Users\Admin\AppData\Local\Temp\484A.tmp"80⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\48B7.tmp"C:\Users\Admin\AppData\Local\Temp\48B7.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:792 -
C:\Users\Admin\AppData\Local\Temp\4925.tmp"C:\Users\Admin\AppData\Local\Temp\4925.tmp"82⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\4992.tmp"C:\Users\Admin\AppData\Local\Temp\4992.tmp"83⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\49FF.tmp"C:\Users\Admin\AppData\Local\Temp\49FF.tmp"84⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"85⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\4ACB.tmp"C:\Users\Admin\AppData\Local\Temp\4ACB.tmp"86⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\4B38.tmp"C:\Users\Admin\AppData\Local\Temp\4B38.tmp"87⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\4BA5.tmp"C:\Users\Admin\AppData\Local\Temp\4BA5.tmp"88⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\4C03.tmp"C:\Users\Admin\AppData\Local\Temp\4C03.tmp"89⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\4C70.tmp"C:\Users\Admin\AppData\Local\Temp\4C70.tmp"90⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\4CCE.tmp"C:\Users\Admin\AppData\Local\Temp\4CCE.tmp"91⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\4D2C.tmp"C:\Users\Admin\AppData\Local\Temp\4D2C.tmp"92⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\4D8A.tmp"C:\Users\Admin\AppData\Local\Temp\4D8A.tmp"93⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\4DE7.tmp"C:\Users\Admin\AppData\Local\Temp\4DE7.tmp"94⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\4E45.tmp"C:\Users\Admin\AppData\Local\Temp\4E45.tmp"95⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\4EA3.tmp"C:\Users\Admin\AppData\Local\Temp\4EA3.tmp"96⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\4F01.tmp"C:\Users\Admin\AppData\Local\Temp\4F01.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\4F6E.tmp"C:\Users\Admin\AppData\Local\Temp\4F6E.tmp"98⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\4FDB.tmp"C:\Users\Admin\AppData\Local\Temp\4FDB.tmp"99⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\5049.tmp"C:\Users\Admin\AppData\Local\Temp\5049.tmp"100⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\50B6.tmp"C:\Users\Admin\AppData\Local\Temp\50B6.tmp"101⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\5124.tmp"C:\Users\Admin\AppData\Local\Temp\5124.tmp"102⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\5191.tmp"C:\Users\Admin\AppData\Local\Temp\5191.tmp"103⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\51EF.tmp"C:\Users\Admin\AppData\Local\Temp\51EF.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\525C.tmp"C:\Users\Admin\AppData\Local\Temp\525C.tmp"105⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\52C9.tmp"C:\Users\Admin\AppData\Local\Temp\52C9.tmp"106⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\5337.tmp"C:\Users\Admin\AppData\Local\Temp\5337.tmp"107⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\53A4.tmp"C:\Users\Admin\AppData\Local\Temp\53A4.tmp"108⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\5412.tmp"C:\Users\Admin\AppData\Local\Temp\5412.tmp"109⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\546F.tmp"C:\Users\Admin\AppData\Local\Temp\546F.tmp"110⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\550C.tmp"C:\Users\Admin\AppData\Local\Temp\550C.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\5598.tmp"C:\Users\Admin\AppData\Local\Temp\5598.tmp"112⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\5625.tmp"C:\Users\Admin\AppData\Local\Temp\5625.tmp"113⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\56C1.tmp"C:\Users\Admin\AppData\Local\Temp\56C1.tmp"114⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\575D.tmp"C:\Users\Admin\AppData\Local\Temp\575D.tmp"115⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\57FA.tmp"C:\Users\Admin\AppData\Local\Temp\57FA.tmp"116⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\5896.tmp"C:\Users\Admin\AppData\Local\Temp\5896.tmp"117⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\5922.tmp"C:\Users\Admin\AppData\Local\Temp\5922.tmp"118⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\59DE.tmp"C:\Users\Admin\AppData\Local\Temp\59DE.tmp"119⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\5A6B.tmp"C:\Users\Admin\AppData\Local\Temp\5A6B.tmp"120⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\5B07.tmp"C:\Users\Admin\AppData\Local\Temp\5B07.tmp"121⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\5BA3.tmp"C:\Users\Admin\AppData\Local\Temp\5BA3.tmp"122⤵PID:2064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-