Analysis
- max time kernel
130s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 05:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_06a5892849d85b843db5e03267bbecf0_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_06a5892849d85b843db5e03267bbecf0_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-08_06a5892849d85b843db5e03267bbecf0_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260808-gmvv3sam4x
- SHA256 6abec9931e1a69ad2cf332e618ffeaf3c830fcec7a22b4c3a760b14759b76610
- MD5 06a5892849d85b843db5e03267bbecf0
- SHA1 343237193d3be9269c75eeaf38337892a42da689
- SHA512 dbe17cae0a7cd8f895ef041b5e143e3f94e6ef06fb23a10c36d61a2429fea72f8ccc127830f58bc7e52e226e1dab929f95c9fad40e662d434de8977be4cfba63
- SSDEEP 12288:wU5rCOTeiDRU4cBCXcKpSZak2Y5Y8vUQNZ+3/v+I9hUG2VA:wUQOJDRUrIclYM/xNGEA
- TLSH T137E4D02177D88532E5FB037859B5EA654D7EBD226722D6CF2F8012BE0A71BD08631723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3340 3985.tmp 3020 3AAE.tmp 2736 3BD6.tmp 4912 3D2E.tmp 5636 3E86.tmp 3444 3FAF.tmp 4996 40F7.tmp 236 4174.tmp 4448 4339.tmp 5712 4452.tmp 2036 454C.tmp 5880 4656.tmp 2564 478E.tmp 5872 48B7.tmp 2396 4992.tmp 4848 4A9C.tmp 2028 4BC5.tmp 2652 4C9F.tmp 3576 4DD8.tmp 4160 4F3F.tmp 2872 50A7.tmp 4320 51CF.tmp 2420 5308.tmp 1884 5402.tmp 952 552B.tmp 2792 5644.tmp 5416 572E.tmp 1308 5848.tmp 5604 5980.tmp 6028 5A7A.tmp 3328 5BF1.tmp 4896 5D59.tmp 4136 5EA1.tmp 3704 5F1E.tmp 2340 6008.tmp 5172 60C4.tmp 3612 6160.tmp 3796 624A.tmp 4364 6325.tmp 3928 641F.tmp 3888 64CB.tmp 2656 6577.tmp 1636 6651.tmp 5668 670D.tmp 4404 67B9.tmp 1816 6894.tmp 3684 6930.tmp 5740 69DC.tmp 3940 6AA7.tmp 2976 6B24.tmp 3548 6BA1.tmp 4648 6C2D.tmp 5576 6CBA.tmp 4808 6D37.tmp 5244 6DA4.tmp 4148 6E31.tmp 6140 6EAE.tmp 1724 6F4A.tmp 3380 6FD7.tmp 2552 7054.tmp 3616 70D1.tmp 1836 713E.tmp 408 71BB.tmp 3308 7248.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F38E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 977E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2826.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 122D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 566E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7011.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F080.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 226E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B56B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D509.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D807.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 247C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 746B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 809B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2603.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C54A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F761.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1123.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E98B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6894.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7601.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A59D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ECF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 540D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 639D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C60.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 956 wrote to memory of 3340 956 2026-08-08_06a5892849d85b843db5e03267bbecf0_elex_mafia_stealc_tofsee.exe 89 PID 3340 wrote to memory of 3020 3340 3985.tmp 90 PID 3020 wrote to memory of 2736 3020 3AAE.tmp 91 PID 2736 wrote to memory of 4912 2736 3BD6.tmp 92 PID 4912 wrote to memory of 5636 4912 3D2E.tmp 93 PID 5636 wrote to memory of 3444 5636 3E86.tmp 94 PID 3444 wrote to memory of 4996 3444 3FAF.tmp 95 PID 4996 wrote to memory of 236 4996 40F7.tmp 96 PID 236 wrote to memory of 4448 236 4174.tmp 97 PID 4448 wrote to memory of 5712 4448 4339.tmp 98 PID 5712 wrote to memory of 2036 5712 4452.tmp 99 PID 2036 wrote to memory of 5880 2036 454C.tmp 100 PID 5880 wrote to memory of 2564 5880 4656.tmp 101 PID 2564 wrote to memory of 5872 2564 478E.tmp 102 PID 5872 wrote to memory of 2396 5872 48B7.tmp 103 PID 2396 wrote to memory of 4848 2396 4992.tmp 104 PID 4848 wrote to memory of 2028 4848 4A9C.tmp 105 PID 2028 wrote to memory of 2652 2028 4BC5.tmp 106 PID 2652 wrote to memory of 3576 2652 4C9F.tmp 107 PID 3576 wrote to memory of 4160 3576 4DD8.tmp 108 PID 4160 wrote to memory of 2872 4160 4F3F.tmp 109 PID 2872 wrote to memory of 4320 2872 50A7.tmp 110 PID 4320 wrote to memory of 2420 4320 51CF.tmp 111 PID 2420 wrote to memory of 1884 2420 5308.tmp 112 PID 1884 wrote to memory of 952 1884 5402.tmp 113 PID 952 wrote to memory of 2792 952 552B.tmp 114 PID 2792 wrote to memory of 5416 2792 5644.tmp 115 PID 5416 wrote to memory of 1308 5416 572E.tmp 116 PID 1308 wrote to memory of 5604 1308 5848.tmp 117 PID 5604 wrote to memory of 6028 5604 5980.tmp 118 PID 6028 wrote to memory of 3328 6028 5A7A.tmp 119 PID 3328 wrote to memory of 4896 3328 5BF1.tmp 120 PID 4896 wrote to memory of 4136 4896 5D59.tmp 121 PID 4136 wrote to memory of 3704 4136 5EA1.tmp 122 PID 3704 wrote to memory of 2340 3704 5F1E.tmp 123 PID 2340 wrote to memory of 5172 2340 6008.tmp 124 PID 5172 wrote to memory of 3612 5172 60C4.tmp 125 PID 3612 wrote to memory of 3796 3612 6160.tmp 126 PID 3796 wrote to memory of 4364 3796 624A.tmp 127 PID 4364 wrote to memory of 3928 4364 6325.tmp 128 PID 3928 wrote to memory of 3888 3928 641F.tmp 129 PID 3888 wrote to memory of 2656 3888 64CB.tmp 130 PID 2656 wrote to memory of 1636 2656 6577.tmp 131 PID 1636 wrote to memory of 5668 1636 6651.tmp 132 PID 5668 wrote to memory of 4404 5668 670D.tmp 133 PID 4404 wrote to memory of 1816 4404 67B9.tmp 134 PID 1816 wrote to memory of 3684 1816 6894.tmp 135 PID 3684 wrote to memory of 5740 3684 6930.tmp 136 PID 5740 wrote to memory of 3940 5740 69DC.tmp 137 PID 3940 wrote to memory of 2976 3940 6AA7.tmp 138 PID 2976 wrote to memory of 3548 2976 6B24.tmp 139 PID 3548 wrote to memory of 4648 3548 6BA1.tmp 140 PID 4648 wrote to memory of 5576 4648 6C2D.tmp 141 PID 5576 wrote to memory of 4808 5576 6CBA.tmp 142 PID 4808 wrote to memory of 5244 4808 6D37.tmp 143 PID 5244 wrote to memory of 4148 5244 6DA4.tmp 144 PID 4148 wrote to memory of 6140 4148 6E31.tmp 145 PID 6140 wrote to memory of 1724 6140 6EAE.tmp 146 PID 1724 wrote to memory of 3380 1724 6F4A.tmp 147 PID 3380 wrote to memory of 2552 3380 6FD7.tmp 148 PID 2552 wrote to memory of 3616 2552 7054.tmp 149 PID 3616 wrote to memory of 1836 3616 70D1.tmp 150 PID 1836 wrote to memory of 408 1836 713E.tmp 151 PID 408 wrote to memory of 3308 408 71BB.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_06a5892849d85b843db5e03267bbecf0_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_06a5892849d85b843db5e03267bbecf0_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\3985.tmp"C:\Users\Admin\AppData\Local\Temp\3985.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\3BD6.tmp"C:\Users\Admin\AppData\Local\Temp\3BD6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\3D2E.tmp"C:\Users\Admin\AppData\Local\Temp\3D2E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\40F7.tmp"C:\Users\Admin\AppData\Local\Temp\40F7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\4174.tmp"C:\Users\Admin\AppData\Local\Temp\4174.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\4339.tmp"C:\Users\Admin\AppData\Local\Temp\4339.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\4452.tmp"C:\Users\Admin\AppData\Local\Temp\4452.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\454C.tmp"C:\Users\Admin\AppData\Local\Temp\454C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\4656.tmp"C:\Users\Admin\AppData\Local\Temp\4656.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\478E.tmp"C:\Users\Admin\AppData\Local\Temp\478E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\48B7.tmp"C:\Users\Admin\AppData\Local\Temp\48B7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\4992.tmp"C:\Users\Admin\AppData\Local\Temp\4992.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\4A9C.tmp"C:\Users\Admin\AppData\Local\Temp\4A9C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\4BC5.tmp"C:\Users\Admin\AppData\Local\Temp\4BC5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\4C9F.tmp"C:\Users\Admin\AppData\Local\Temp\4C9F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\4DD8.tmp"C:\Users\Admin\AppData\Local\Temp\4DD8.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\4F3F.tmp"C:\Users\Admin\AppData\Local\Temp\4F3F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\50A7.tmp"C:\Users\Admin\AppData\Local\Temp\50A7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\51CF.tmp"C:\Users\Admin\AppData\Local\Temp\51CF.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\5308.tmp"C:\Users\Admin\AppData\Local\Temp\5308.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\5402.tmp"C:\Users\Admin\AppData\Local\Temp\5402.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\552B.tmp"C:\Users\Admin\AppData\Local\Temp\552B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\5644.tmp"C:\Users\Admin\AppData\Local\Temp\5644.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\572E.tmp"C:\Users\Admin\AppData\Local\Temp\572E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\5848.tmp"C:\Users\Admin\AppData\Local\Temp\5848.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\5980.tmp"C:\Users\Admin\AppData\Local\Temp\5980.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\5BF1.tmp"C:\Users\Admin\AppData\Local\Temp\5BF1.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\5D59.tmp"C:\Users\Admin\AppData\Local\Temp\5D59.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\5EA1.tmp"C:\Users\Admin\AppData\Local\Temp\5EA1.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\5F1E.tmp"C:\Users\Admin\AppData\Local\Temp\5F1E.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\6008.tmp"C:\Users\Admin\AppData\Local\Temp\6008.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\60C4.tmp"C:\Users\Admin\AppData\Local\Temp\60C4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\6160.tmp"C:\Users\Admin\AppData\Local\Temp\6160.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\624A.tmp"C:\Users\Admin\AppData\Local\Temp\624A.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\6325.tmp"C:\Users\Admin\AppData\Local\Temp\6325.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\641F.tmp"C:\Users\Admin\AppData\Local\Temp\641F.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\6577.tmp"C:\Users\Admin\AppData\Local\Temp\6577.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\6651.tmp"C:\Users\Admin\AppData\Local\Temp\6651.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\670D.tmp"C:\Users\Admin\AppData\Local\Temp\670D.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\67B9.tmp"C:\Users\Admin\AppData\Local\Temp\67B9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\6894.tmp"C:\Users\Admin\AppData\Local\Temp\6894.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\6930.tmp"C:\Users\Admin\AppData\Local\Temp\6930.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\69DC.tmp"C:\Users\Admin\AppData\Local\Temp\69DC.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\6AA7.tmp"C:\Users\Admin\AppData\Local\Temp\6AA7.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\6B24.tmp"C:\Users\Admin\AppData\Local\Temp\6B24.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\6BA1.tmp"C:\Users\Admin\AppData\Local\Temp\6BA1.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\6C2D.tmp"C:\Users\Admin\AppData\Local\Temp\6C2D.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\6CBA.tmp"C:\Users\Admin\AppData\Local\Temp\6CBA.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\6D37.tmp"C:\Users\Admin\AppData\Local\Temp\6D37.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\6DA4.tmp"C:\Users\Admin\AppData\Local\Temp\6DA4.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\6E31.tmp"C:\Users\Admin\AppData\Local\Temp\6E31.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\6EAE.tmp"C:\Users\Admin\AppData\Local\Temp\6EAE.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\6F4A.tmp"C:\Users\Admin\AppData\Local\Temp\6F4A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\6FD7.tmp"C:\Users\Admin\AppData\Local\Temp\6FD7.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\7054.tmp"C:\Users\Admin\AppData\Local\Temp\7054.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\70D1.tmp"C:\Users\Admin\AppData\Local\Temp\70D1.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\713E.tmp"C:\Users\Admin\AppData\Local\Temp\713E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\71BB.tmp"C:\Users\Admin\AppData\Local\Temp\71BB.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\7248.tmp"C:\Users\Admin\AppData\Local\Temp\7248.tmp"65⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\72E4.tmp"C:\Users\Admin\AppData\Local\Temp\72E4.tmp"66⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\7371.tmp"C:\Users\Admin\AppData\Local\Temp\7371.tmp"67⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\73DE.tmp"C:\Users\Admin\AppData\Local\Temp\73DE.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\746B.tmp"C:\Users\Admin\AppData\Local\Temp\746B.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\74F7.tmp"C:\Users\Admin\AppData\Local\Temp\74F7.tmp"70⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\7574.tmp"C:\Users\Admin\AppData\Local\Temp\7574.tmp"71⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\7601.tmp"C:\Users\Admin\AppData\Local\Temp\7601.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\769D.tmp"C:\Users\Admin\AppData\Local\Temp\769D.tmp"73⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\771A.tmp"C:\Users\Admin\AppData\Local\Temp\771A.tmp"74⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\7797.tmp"C:\Users\Admin\AppData\Local\Temp\7797.tmp"75⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\7834.tmp"C:\Users\Admin\AppData\Local\Temp\7834.tmp"76⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\78D0.tmp"C:\Users\Admin\AppData\Local\Temp\78D0.tmp"77⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\795C.tmp"C:\Users\Admin\AppData\Local\Temp\795C.tmp"78⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\79F9.tmp"C:\Users\Admin\AppData\Local\Temp\79F9.tmp"79⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\7AB4.tmp"C:\Users\Admin\AppData\Local\Temp\7AB4.tmp"80⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\7B70.tmp"C:\Users\Admin\AppData\Local\Temp\7B70.tmp"81⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\7C1C.tmp"C:\Users\Admin\AppData\Local\Temp\7C1C.tmp"82⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\7CB8.tmp"C:\Users\Admin\AppData\Local\Temp\7CB8.tmp"83⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\7D64.tmp"C:\Users\Admin\AppData\Local\Temp\7D64.tmp"84⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\7E10.tmp"C:\Users\Admin\AppData\Local\Temp\7E10.tmp"85⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\7E9C.tmp"C:\Users\Admin\AppData\Local\Temp\7E9C.tmp"86⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\7F48.tmp"C:\Users\Admin\AppData\Local\Temp\7F48.tmp"87⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"88⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\8090.tmp"C:\Users\Admin\AppData\Local\Temp\8090.tmp"89⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\813C.tmp"C:\Users\Admin\AppData\Local\Temp\813C.tmp"90⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\81C9.tmp"C:\Users\Admin\AppData\Local\Temp\81C9.tmp"91⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\8275.tmp"C:\Users\Admin\AppData\Local\Temp\8275.tmp"92⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\8320.tmp"C:\Users\Admin\AppData\Local\Temp\8320.tmp"93⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\83DC.tmp"C:\Users\Admin\AppData\Local\Temp\83DC.tmp"94⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\8459.tmp"C:\Users\Admin\AppData\Local\Temp\8459.tmp"95⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\84E6.tmp"C:\Users\Admin\AppData\Local\Temp\84E6.tmp"96⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\8582.tmp"C:\Users\Admin\AppData\Local\Temp\8582.tmp"97⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\860E.tmp"C:\Users\Admin\AppData\Local\Temp\860E.tmp"98⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\86BA.tmp"C:\Users\Admin\AppData\Local\Temp\86BA.tmp"99⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\8747.tmp"C:\Users\Admin\AppData\Local\Temp\8747.tmp"100⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\87D4.tmp"C:\Users\Admin\AppData\Local\Temp\87D4.tmp"101⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\8851.tmp"C:\Users\Admin\AppData\Local\Temp\8851.tmp"102⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\88CE.tmp"C:\Users\Admin\AppData\Local\Temp\88CE.tmp"103⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\8979.tmp"C:\Users\Admin\AppData\Local\Temp\8979.tmp"104⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\89F6.tmp"C:\Users\Admin\AppData\Local\Temp\89F6.tmp"105⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\8A83.tmp"C:\Users\Admin\AppData\Local\Temp\8A83.tmp"106⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\8B00.tmp"C:\Users\Admin\AppData\Local\Temp\8B00.tmp"107⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"108⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\8C19.tmp"C:\Users\Admin\AppData\Local\Temp\8C19.tmp"109⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"110⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\8D52.tmp"C:\Users\Admin\AppData\Local\Temp\8D52.tmp"111⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"112⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"C:\Users\Admin\AppData\Local\Temp\8E5B.tmp"113⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\8EC9.tmp"C:\Users\Admin\AppData\Local\Temp\8EC9.tmp"114⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\8F55.tmp"C:\Users\Admin\AppData\Local\Temp\8F55.tmp"115⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\8FD2.tmp"C:\Users\Admin\AppData\Local\Temp\8FD2.tmp"116⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\904F.tmp"C:\Users\Admin\AppData\Local\Temp\904F.tmp"117⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\90FB.tmp"C:\Users\Admin\AppData\Local\Temp\90FB.tmp"118⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\9188.tmp"C:\Users\Admin\AppData\Local\Temp\9188.tmp"119⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\9215.tmp"C:\Users\Admin\AppData\Local\Temp\9215.tmp"120⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\92A1.tmp"C:\Users\Admin\AppData\Local\Temp\92A1.tmp"121⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\932E.tmp"C:\Users\Admin\AppData\Local\Temp\932E.tmp"122⤵PID:2164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-