Analysis
- max time kernel
129s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 13:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_f2d3a615f09c6caa9c44615f6fc8659d_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_f2d3a615f09c6caa9c44615f6fc8659d_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-08_f2d3a615f09c6caa9c44615f6fc8659d_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260808-qlft7sdf57
- SHA256 913c66efc6d291ec8d8b3f310122a7cb52bb5e2ebcbe8c6cccfa8f8e61618da8
- MD5 f2d3a615f09c6caa9c44615f6fc8659d
- SHA1 1c0fb6d2b0c8a9226c2862926711f41d83807b28
- SHA512 880f1296168b9a8d2e4b6212b8629e29611de1ab7dcf02f7ad78ed6bc8f7da6d5b8af1bec24e82003650116354587c2c94586411490d97e637c8442795c38a71
- SSDEEP 12288:9U5rCOTei6F1NgCmTBn/aAPH4mBLqZoXWjdq:9UQOJ61gCmoAPYmBLqqGh
- TLSH T1BBC4F1257A44C132E99212314EE2EBB2297A7C755B26A4C77BC0776E2FB52D1D338307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3400 49FB.tmp 4164 4AB6.tmp 5448 4BA1.tmp 5680 4C8B.tmp 2096 4D37.tmp 5928 4DB4.tmp 5376 4E60.tmp 5392 4F5A.tmp 3344 50B1.tmp 4116 516D.tmp 4480 5257.tmp 3364 5303.tmp 296 53BF.tmp 1676 547A.tmp 1040 5526.tmp 5408 55F1.tmp 5568 569D.tmp 1212 571A.tmp 2576 57C6.tmp 5108 5872.tmp 1672 58FE.tmp 5424 599B.tmp 628 5A85.tmp 1252 5B41.tmp 5072 5BEC.tmp 4204 5CC7.tmp 2616 5D73.tmp 5480 5E3E.tmp 4496 5EFA.tmp 4064 5FC5.tmp 4264 60A0.tmp 5620 615B.tmp 2856 61C8.tmp 3228 6236.tmp 5040 62C2.tmp 3288 634F.tmp 5176 63CC.tmp 1972 6449.tmp 256 64D6.tmp 364 6553.tmp 3168 65D0.tmp 5776 663D.tmp 1216 66BA.tmp 4852 6727.tmp 3112 6795.tmp 2336 6821.tmp 2708 68AE.tmp 1968 692B.tmp 4184 69A8.tmp 5432 6A35.tmp 5504 6AC1.tmp 3316 6B2F.tmp 3212 6BAC.tmp 4500 6C38.tmp 4556 6CD5.tmp 1456 6D61.tmp 4136 6DCF.tmp 1300 6E4C.tmp 1388 6ED8.tmp 6068 6F46.tmp 4984 6FD2.tmp 3120 705F.tmp 3432 70EB.tmp 4640 71A7.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E079.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1891.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_f2d3a615f09c6caa9c44615f6fc8659d_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D64D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 273B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 878C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A600.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F704.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D15B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E57F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F08B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 518.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3560.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A663.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E159.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 286F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C824.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7471.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C243.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3025.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F667.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 145F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9576.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B581.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3267.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 586.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 127B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4514.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 217A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1184 wrote to memory of 3400 1184 2026-08-08_f2d3a615f09c6caa9c44615f6fc8659d_elex_mafia_stealc_tofsee.exe 88 PID 3400 wrote to memory of 4164 3400 49FB.tmp 89 PID 4164 wrote to memory of 5448 4164 4AB6.tmp 90 PID 5448 wrote to memory of 5680 5448 4BA1.tmp 91 PID 5680 wrote to memory of 2096 5680 4C8B.tmp 92 PID 2096 wrote to memory of 5928 2096 4D37.tmp 93 PID 5928 wrote to memory of 5376 5928 4DB4.tmp 94 PID 5376 wrote to memory of 5392 5376 4E60.tmp 95 PID 5392 wrote to memory of 3344 5392 4F5A.tmp 96 PID 3344 wrote to memory of 4116 3344 50B1.tmp 97 PID 4116 wrote to memory of 4480 4116 516D.tmp 98 PID 4480 wrote to memory of 3364 4480 5257.tmp 99 PID 3364 wrote to memory of 296 3364 5303.tmp 100 PID 296 wrote to memory of 1676 296 53BF.tmp 101 PID 1676 wrote to memory of 1040 1676 547A.tmp 102 PID 1040 wrote to memory of 5408 1040 5526.tmp 103 PID 5408 wrote to memory of 5568 5408 55F1.tmp 104 PID 5568 wrote to memory of 1212 5568 569D.tmp 105 PID 1212 wrote to memory of 2576 1212 571A.tmp 106 PID 2576 wrote to memory of 5108 2576 57C6.tmp 107 PID 5108 wrote to memory of 1672 5108 5872.tmp 108 PID 1672 wrote to memory of 5424 1672 58FE.tmp 109 PID 5424 wrote to memory of 628 5424 599B.tmp 110 PID 628 wrote to memory of 1252 628 5A85.tmp 111 PID 1252 wrote to memory of 5072 1252 5B41.tmp 112 PID 5072 wrote to memory of 4204 5072 5BEC.tmp 113 PID 4204 wrote to memory of 2616 4204 5CC7.tmp 114 PID 2616 wrote to memory of 5480 2616 5D73.tmp 115 PID 5480 wrote to memory of 4496 5480 5E3E.tmp 116 PID 4496 wrote to memory of 4064 4496 5EFA.tmp 117 PID 4064 wrote to memory of 4264 4064 5FC5.tmp 118 PID 4264 wrote to memory of 5620 4264 60A0.tmp 119 PID 5620 wrote to memory of 2856 5620 615B.tmp 120 PID 2856 wrote to memory of 3228 2856 61C8.tmp 121 PID 3228 wrote to memory of 5040 3228 6236.tmp 122 PID 5040 wrote to memory of 3288 5040 62C2.tmp 123 PID 3288 wrote to memory of 5176 3288 634F.tmp 124 PID 5176 wrote to memory of 1972 5176 63CC.tmp 125 PID 1972 wrote to memory of 256 1972 6449.tmp 126 PID 256 wrote to memory of 364 256 64D6.tmp 127 PID 364 wrote to memory of 3168 364 6553.tmp 128 PID 3168 wrote to memory of 5776 3168 65D0.tmp 129 PID 5776 wrote to memory of 1216 5776 663D.tmp 130 PID 1216 wrote to memory of 4852 1216 66BA.tmp 131 PID 4852 wrote to memory of 3112 4852 6727.tmp 132 PID 3112 wrote to memory of 2336 3112 6795.tmp 133 PID 2336 wrote to memory of 2708 2336 6821.tmp 134 PID 2708 wrote to memory of 1968 2708 68AE.tmp 135 PID 1968 wrote to memory of 4184 1968 692B.tmp 136 PID 4184 wrote to memory of 5432 4184 69A8.tmp 137 PID 5432 wrote to memory of 5504 5432 6A35.tmp 138 PID 5504 wrote to memory of 3316 5504 6AC1.tmp 139 PID 3316 wrote to memory of 3212 3316 6B2F.tmp 140 PID 3212 wrote to memory of 4500 3212 6BAC.tmp 141 PID 4500 wrote to memory of 4556 4500 6C38.tmp 142 PID 4556 wrote to memory of 1456 4556 6CD5.tmp 143 PID 1456 wrote to memory of 4136 1456 6D61.tmp 144 PID 4136 wrote to memory of 1300 4136 6DCF.tmp 145 PID 1300 wrote to memory of 1388 1300 6E4C.tmp 146 PID 1388 wrote to memory of 6068 1388 6ED8.tmp 147 PID 6068 wrote to memory of 4984 6068 6F46.tmp 148 PID 4984 wrote to memory of 3120 4984 6FD2.tmp 149 PID 3120 wrote to memory of 3432 3120 705F.tmp 150 PID 3432 wrote to memory of 4640 3432 70EB.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f2d3a615f09c6caa9c44615f6fc8659d_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f2d3a615f09c6caa9c44615f6fc8659d_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\49FB.tmp"C:\Users\Admin\AppData\Local\Temp\49FB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\4BA1.tmp"C:\Users\Admin\AppData\Local\Temp\4BA1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\4C8B.tmp"C:\Users\Admin\AppData\Local\Temp\4C8B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\4D37.tmp"C:\Users\Admin\AppData\Local\Temp\4D37.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\4DB4.tmp"C:\Users\Admin\AppData\Local\Temp\4DB4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\4E60.tmp"C:\Users\Admin\AppData\Local\Temp\4E60.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\4F5A.tmp"C:\Users\Admin\AppData\Local\Temp\4F5A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\50B1.tmp"C:\Users\Admin\AppData\Local\Temp\50B1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\516D.tmp"C:\Users\Admin\AppData\Local\Temp\516D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\5257.tmp"C:\Users\Admin\AppData\Local\Temp\5257.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\5303.tmp"C:\Users\Admin\AppData\Local\Temp\5303.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\53BF.tmp"C:\Users\Admin\AppData\Local\Temp\53BF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Users\Admin\AppData\Local\Temp\547A.tmp"C:\Users\Admin\AppData\Local\Temp\547A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\5526.tmp"C:\Users\Admin\AppData\Local\Temp\5526.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\55F1.tmp"C:\Users\Admin\AppData\Local\Temp\55F1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\569D.tmp"C:\Users\Admin\AppData\Local\Temp\569D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\571A.tmp"C:\Users\Admin\AppData\Local\Temp\571A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\57C6.tmp"C:\Users\Admin\AppData\Local\Temp\57C6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\5872.tmp"C:\Users\Admin\AppData\Local\Temp\5872.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\58FE.tmp"C:\Users\Admin\AppData\Local\Temp\58FE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\599B.tmp"C:\Users\Admin\AppData\Local\Temp\599B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\5A85.tmp"C:\Users\Admin\AppData\Local\Temp\5A85.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\5B41.tmp"C:\Users\Admin\AppData\Local\Temp\5B41.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\5BEC.tmp"C:\Users\Admin\AppData\Local\Temp\5BEC.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\5CC7.tmp"C:\Users\Admin\AppData\Local\Temp\5CC7.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\5D73.tmp"C:\Users\Admin\AppData\Local\Temp\5D73.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\5E3E.tmp"C:\Users\Admin\AppData\Local\Temp\5E3E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Users\Admin\AppData\Local\Temp\5EFA.tmp"C:\Users\Admin\AppData\Local\Temp\5EFA.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\5FC5.tmp"C:\Users\Admin\AppData\Local\Temp\5FC5.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\60A0.tmp"C:\Users\Admin\AppData\Local\Temp\60A0.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\615B.tmp"C:\Users\Admin\AppData\Local\Temp\615B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\61C8.tmp"C:\Users\Admin\AppData\Local\Temp\61C8.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\6236.tmp"C:\Users\Admin\AppData\Local\Temp\6236.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\62C2.tmp"C:\Users\Admin\AppData\Local\Temp\62C2.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\634F.tmp"C:\Users\Admin\AppData\Local\Temp\634F.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\63CC.tmp"C:\Users\Admin\AppData\Local\Temp\63CC.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5176 -
C:\Users\Admin\AppData\Local\Temp\6449.tmp"C:\Users\Admin\AppData\Local\Temp\6449.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\64D6.tmp"C:\Users\Admin\AppData\Local\Temp\64D6.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\6553.tmp"C:\Users\Admin\AppData\Local\Temp\6553.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\65D0.tmp"C:\Users\Admin\AppData\Local\Temp\65D0.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\663D.tmp"C:\Users\Admin\AppData\Local\Temp\663D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\66BA.tmp"C:\Users\Admin\AppData\Local\Temp\66BA.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\6727.tmp"C:\Users\Admin\AppData\Local\Temp\6727.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\6795.tmp"C:\Users\Admin\AppData\Local\Temp\6795.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\6821.tmp"C:\Users\Admin\AppData\Local\Temp\6821.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\68AE.tmp"C:\Users\Admin\AppData\Local\Temp\68AE.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\692B.tmp"C:\Users\Admin\AppData\Local\Temp\692B.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\69A8.tmp"C:\Users\Admin\AppData\Local\Temp\69A8.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\6A35.tmp"C:\Users\Admin\AppData\Local\Temp\6A35.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\6AC1.tmp"C:\Users\Admin\AppData\Local\Temp\6AC1.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\6B2F.tmp"C:\Users\Admin\AppData\Local\Temp\6B2F.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\6BAC.tmp"C:\Users\Admin\AppData\Local\Temp\6BAC.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\6C38.tmp"C:\Users\Admin\AppData\Local\Temp\6C38.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\6CD5.tmp"C:\Users\Admin\AppData\Local\Temp\6CD5.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\6D61.tmp"C:\Users\Admin\AppData\Local\Temp\6D61.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\6DCF.tmp"C:\Users\Admin\AppData\Local\Temp\6DCF.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\6E4C.tmp"C:\Users\Admin\AppData\Local\Temp\6E4C.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\6ED8.tmp"C:\Users\Admin\AppData\Local\Temp\6ED8.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\6F46.tmp"C:\Users\Admin\AppData\Local\Temp\6F46.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\6FD2.tmp"C:\Users\Admin\AppData\Local\Temp\6FD2.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\705F.tmp"C:\Users\Admin\AppData\Local\Temp\705F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\70EB.tmp"C:\Users\Admin\AppData\Local\Temp\70EB.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"65⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"66⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\72B1.tmp"C:\Users\Admin\AppData\Local\Temp\72B1.tmp"67⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\732E.tmp"C:\Users\Admin\AppData\Local\Temp\732E.tmp"68⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\739B.tmp"C:\Users\Admin\AppData\Local\Temp\739B.tmp"69⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\73F9.tmp"C:\Users\Admin\AppData\Local\Temp\73F9.tmp"70⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\7476.tmp"C:\Users\Admin\AppData\Local\Temp\7476.tmp"71⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\74E3.tmp"C:\Users\Admin\AppData\Local\Temp\74E3.tmp"72⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\7570.tmp"C:\Users\Admin\AppData\Local\Temp\7570.tmp"73⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\75FC.tmp"C:\Users\Admin\AppData\Local\Temp\75FC.tmp"74⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\7679.tmp"C:\Users\Admin\AppData\Local\Temp\7679.tmp"75⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\76F6.tmp"C:\Users\Admin\AppData\Local\Temp\76F6.tmp"76⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\7783.tmp"C:\Users\Admin\AppData\Local\Temp\7783.tmp"77⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\7810.tmp"C:\Users\Admin\AppData\Local\Temp\7810.tmp"78⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\78AC.tmp"C:\Users\Admin\AppData\Local\Temp\78AC.tmp"79⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\7919.tmp"C:\Users\Admin\AppData\Local\Temp\7919.tmp"80⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\79A6.tmp"C:\Users\Admin\AppData\Local\Temp\79A6.tmp"81⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\7A23.tmp"C:\Users\Admin\AppData\Local\Temp\7A23.tmp"82⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\7AA0.tmp"C:\Users\Admin\AppData\Local\Temp\7AA0.tmp"83⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\7B0D.tmp"C:\Users\Admin\AppData\Local\Temp\7B0D.tmp"84⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\7BB9.tmp"C:\Users\Admin\AppData\Local\Temp\7BB9.tmp"85⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\7C46.tmp"C:\Users\Admin\AppData\Local\Temp\7C46.tmp"86⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\7CD2.tmp"C:\Users\Admin\AppData\Local\Temp\7CD2.tmp"87⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\7D5F.tmp"C:\Users\Admin\AppData\Local\Temp\7D5F.tmp"88⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\7DEC.tmp"C:\Users\Admin\AppData\Local\Temp\7DEC.tmp"89⤵PID:5440
-
C:\Users\Admin\AppData\Local\Temp\7E59.tmp"C:\Users\Admin\AppData\Local\Temp\7E59.tmp"90⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\7EC6.tmp"C:\Users\Admin\AppData\Local\Temp\7EC6.tmp"91⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\7F63.tmp"C:\Users\Admin\AppData\Local\Temp\7F63.tmp"92⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\7FE0.tmp"C:\Users\Admin\AppData\Local\Temp\7FE0.tmp"93⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\804D.tmp"C:\Users\Admin\AppData\Local\Temp\804D.tmp"94⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\80CA.tmp"C:\Users\Admin\AppData\Local\Temp\80CA.tmp"95⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\8137.tmp"C:\Users\Admin\AppData\Local\Temp\8137.tmp"96⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\81C4.tmp"C:\Users\Admin\AppData\Local\Temp\81C4.tmp"97⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\8251.tmp"C:\Users\Admin\AppData\Local\Temp\8251.tmp"98⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\82ED.tmp"C:\Users\Admin\AppData\Local\Temp\82ED.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\8379.tmp"C:\Users\Admin\AppData\Local\Temp\8379.tmp"100⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\83E7.tmp"C:\Users\Admin\AppData\Local\Temp\83E7.tmp"101⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\8454.tmp"C:\Users\Admin\AppData\Local\Temp\8454.tmp"102⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\84B2.tmp"C:\Users\Admin\AppData\Local\Temp\84B2.tmp"103⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\853F.tmp"C:\Users\Admin\AppData\Local\Temp\853F.tmp"104⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\85AC.tmp"C:\Users\Admin\AppData\Local\Temp\85AC.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\8629.tmp"C:\Users\Admin\AppData\Local\Temp\8629.tmp"106⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\86A6.tmp"C:\Users\Admin\AppData\Local\Temp\86A6.tmp"107⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\8733.tmp"C:\Users\Admin\AppData\Local\Temp\8733.tmp"108⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\87B0.tmp"C:\Users\Admin\AppData\Local\Temp\87B0.tmp"109⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\883C.tmp"C:\Users\Admin\AppData\Local\Temp\883C.tmp"110⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\88AA.tmp"C:\Users\Admin\AppData\Local\Temp\88AA.tmp"111⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\8907.tmp"C:\Users\Admin\AppData\Local\Temp\8907.tmp"112⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\8994.tmp"C:\Users\Admin\AppData\Local\Temp\8994.tmp"113⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\8A11.tmp"C:\Users\Admin\AppData\Local\Temp\8A11.tmp"114⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\8AAD.tmp"C:\Users\Admin\AppData\Local\Temp\8AAD.tmp"115⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\8B59.tmp"C:\Users\Admin\AppData\Local\Temp\8B59.tmp"116⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\8BD6.tmp"C:\Users\Admin\AppData\Local\Temp\8BD6.tmp"117⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\8C53.tmp"C:\Users\Admin\AppData\Local\Temp\8C53.tmp"118⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\8CC0.tmp"C:\Users\Admin\AppData\Local\Temp\8CC0.tmp"119⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\8D2E.tmp"C:\Users\Admin\AppData\Local\Temp\8D2E.tmp"120⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\8DAB.tmp"C:\Users\Admin\AppData\Local\Temp\8DAB.tmp"121⤵PID:5148
-
C:\Users\Admin\AppData\Local\Temp\8E18.tmp"C:\Users\Admin\AppData\Local\Temp\8E18.tmp"122⤵PID:2464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-