Analysis
- max time kernel
119s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 13:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_cc9b881ce6531ce0d2c7cc06f8df8782_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_cc9b881ce6531ce0d2c7cc06f8df8782_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-09_cc9b881ce6531ce0d2c7cc06f8df8782_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260809-qyesnsydpg
- SHA256 29199000e7b9a2f95d2bdbb8d38f214811d12645499e93a66f26c7189a4d39c3
- MD5 cc9b881ce6531ce0d2c7cc06f8df8782
- SHA1 8753da06c39e76dc701452ad22692588e4d1e00e
- SHA512 47deb169ad30c7395033e00d396182a381fb87f64d4fd5361776e591149820db45744e6581ebabdd216778fdfa486bc3a4f1f49b22e1b1ccdd985e15dfbd803e
- SSDEEP 12288:9U5rCOTei6EZsD9exKDuaD/FqZoXWjdq:9UQOJ6ksD9CKjbFqqGh
- TLSH T1D5C4F121B584C032E58211318EE6EBB2597BBD355B2A64C77BD0A72E6FB42E1D374307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3932 60C4.tmp 2620 617F.tmp 2656 61FC.tmp 2440 6306.tmp 2184 64FA.tmp 3680 6596.tmp 1884 6642.tmp 6096 66FD.tmp 5992 67C8.tmp 2296 6845.tmp 1280 6920.tmp 2824 69CC.tmp 4940 6A68.tmp 956 6B14.tmp 5264 6BD0.tmp 1128 6CAA.tmp 5640 6D66.tmp 1324 6E12.tmp 1864 6EED.tmp 3240 6FA8.tmp 2008 7015.tmp 2136 7092.tmp 2056 7100.tmp 2428 716D.tmp 5744 71DB.tmp 628 7258.tmp 3188 72B5.tmp 4864 7332.tmp 4056 73AF.tmp 2996 742C.tmp 4556 749A.tmp 5488 7507.tmp 5644 7565.tmp 5064 75D2.tmp 784 7640.tmp 4640 76AD.tmp 4252 771A.tmp 2872 7778.tmp 1220 77D6.tmp 5080 7834.tmp 6028 78A1.tmp 3256 78FF.tmp 5552 795C.tmp 6108 79CA.tmp 4308 7A28.tmp 704 7A95.tmp 4920 7AF3.tmp 2396 7B50.tmp 5500 7BAE.tmp 3640 7C0C.tmp 1968 7C6A.tmp 1868 7CC7.tmp 5372 7D25.tmp 3520 7DC1.tmp 5580 7E6D.tmp 5492 7EEA.tmp 2348 7F67.tmp 4232 7FE4.tmp 4440 8061.tmp 4080 80DE.tmp 2876 815B.tmp 3472 81D8.tmp 3420 8255.tmp 5696 8301.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 637E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 705F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C804.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B193.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E63F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6090.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E536.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A50B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B622.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F84C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 245D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7778.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1648.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A876.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C516.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1980.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7565.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C74E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5092.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A483.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 294F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 815B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B71C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7332.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 353A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5308 wrote to memory of 3932 5308 2026-08-09_cc9b881ce6531ce0d2c7cc06f8df8782_elex_mafia_stealc_tofsee.exe 89 PID 3932 wrote to memory of 2620 3932 60C4.tmp 90 PID 2620 wrote to memory of 2656 2620 617F.tmp 91 PID 2656 wrote to memory of 2440 2656 61FC.tmp 92 PID 2440 wrote to memory of 2184 2440 6306.tmp 93 PID 2184 wrote to memory of 3680 2184 64FA.tmp 94 PID 3680 wrote to memory of 1884 3680 6596.tmp 95 PID 1884 wrote to memory of 6096 1884 6642.tmp 96 PID 6096 wrote to memory of 5992 6096 66FD.tmp 97 PID 5992 wrote to memory of 2296 5992 67C8.tmp 98 PID 2296 wrote to memory of 1280 2296 6845.tmp 99 PID 1280 wrote to memory of 2824 1280 6920.tmp 100 PID 2824 wrote to memory of 4940 2824 69CC.tmp 101 PID 4940 wrote to memory of 956 4940 6A68.tmp 102 PID 956 wrote to memory of 5264 956 6B14.tmp 103 PID 5264 wrote to memory of 1128 5264 6BD0.tmp 104 PID 1128 wrote to memory of 5640 1128 6CAA.tmp 105 PID 5640 wrote to memory of 1324 5640 6D66.tmp 106 PID 1324 wrote to memory of 1864 1324 6E12.tmp 107 PID 1864 wrote to memory of 3240 1864 6EED.tmp 108 PID 3240 wrote to memory of 2008 3240 6FA8.tmp 109 PID 2008 wrote to memory of 2136 2008 7015.tmp 110 PID 2136 wrote to memory of 2056 2136 7092.tmp 111 PID 2056 wrote to memory of 2428 2056 7100.tmp 112 PID 2428 wrote to memory of 5744 2428 716D.tmp 113 PID 5744 wrote to memory of 628 5744 71DB.tmp 114 PID 628 wrote to memory of 3188 628 7258.tmp 115 PID 3188 wrote to memory of 4864 3188 72B5.tmp 116 PID 4864 wrote to memory of 4056 4864 7332.tmp 117 PID 4056 wrote to memory of 2996 4056 73AF.tmp 118 PID 2996 wrote to memory of 4556 2996 742C.tmp 119 PID 4556 wrote to memory of 5488 4556 749A.tmp 120 PID 5488 wrote to memory of 5644 5488 7507.tmp 121 PID 5644 wrote to memory of 5064 5644 7565.tmp 122 PID 5064 wrote to memory of 784 5064 75D2.tmp 123 PID 784 wrote to memory of 4640 784 7640.tmp 124 PID 4640 wrote to memory of 4252 4640 76AD.tmp 125 PID 4252 wrote to memory of 2872 4252 771A.tmp 126 PID 2872 wrote to memory of 1220 2872 7778.tmp 127 PID 1220 wrote to memory of 5080 1220 77D6.tmp 128 PID 5080 wrote to memory of 6028 5080 7834.tmp 129 PID 6028 wrote to memory of 3256 6028 78A1.tmp 130 PID 3256 wrote to memory of 5552 3256 78FF.tmp 131 PID 5552 wrote to memory of 6108 5552 795C.tmp 132 PID 6108 wrote to memory of 4308 6108 79CA.tmp 133 PID 4308 wrote to memory of 704 4308 7A28.tmp 134 PID 704 wrote to memory of 4920 704 7A95.tmp 135 PID 4920 wrote to memory of 2396 4920 7AF3.tmp 136 PID 2396 wrote to memory of 5500 2396 7B50.tmp 137 PID 5500 wrote to memory of 3640 5500 7BAE.tmp 138 PID 3640 wrote to memory of 1968 3640 7C0C.tmp 139 PID 1968 wrote to memory of 1868 1968 7C6A.tmp 140 PID 1868 wrote to memory of 5372 1868 7CC7.tmp 141 PID 5372 wrote to memory of 3520 5372 7D25.tmp 142 PID 3520 wrote to memory of 5580 3520 7DC1.tmp 143 PID 5580 wrote to memory of 5492 5580 7E6D.tmp 144 PID 5492 wrote to memory of 2348 5492 7EEA.tmp 145 PID 2348 wrote to memory of 4232 2348 7F67.tmp 146 PID 4232 wrote to memory of 4440 4232 7FE4.tmp 147 PID 4440 wrote to memory of 4080 4440 8061.tmp 148 PID 4080 wrote to memory of 2876 4080 80DE.tmp 149 PID 2876 wrote to memory of 3472 2876 815B.tmp 150 PID 3472 wrote to memory of 3420 3472 81D8.tmp 151 PID 3420 wrote to memory of 5696 3420 8255.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_cc9b881ce6531ce0d2c7cc06f8df8782_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_cc9b881ce6531ce0d2c7cc06f8df8782_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\60C4.tmp"C:\Users\Admin\AppData\Local\Temp\60C4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\617F.tmp"C:\Users\Admin\AppData\Local\Temp\617F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\61FC.tmp"C:\Users\Admin\AppData\Local\Temp\61FC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\6306.tmp"C:\Users\Admin\AppData\Local\Temp\6306.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\64FA.tmp"C:\Users\Admin\AppData\Local\Temp\64FA.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\66FD.tmp"C:\Users\Admin\AppData\Local\Temp\66FD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\6845.tmp"C:\Users\Admin\AppData\Local\Temp\6845.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\6920.tmp"C:\Users\Admin\AppData\Local\Temp\6920.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\69CC.tmp"C:\Users\Admin\AppData\Local\Temp\69CC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\6A68.tmp"C:\Users\Admin\AppData\Local\Temp\6A68.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\6B14.tmp"C:\Users\Admin\AppData\Local\Temp\6B14.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\6BD0.tmp"C:\Users\Admin\AppData\Local\Temp\6BD0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\6D66.tmp"C:\Users\Admin\AppData\Local\Temp\6D66.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\6E12.tmp"C:\Users\Admin\AppData\Local\Temp\6E12.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\6EED.tmp"C:\Users\Admin\AppData\Local\Temp\6EED.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\6FA8.tmp"C:\Users\Admin\AppData\Local\Temp\6FA8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\7015.tmp"C:\Users\Admin\AppData\Local\Temp\7015.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\7092.tmp"C:\Users\Admin\AppData\Local\Temp\7092.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\7100.tmp"C:\Users\Admin\AppData\Local\Temp\7100.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\716D.tmp"C:\Users\Admin\AppData\Local\Temp\716D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\71DB.tmp"C:\Users\Admin\AppData\Local\Temp\71DB.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\7258.tmp"C:\Users\Admin\AppData\Local\Temp\7258.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\72B5.tmp"C:\Users\Admin\AppData\Local\Temp\72B5.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\7332.tmp"C:\Users\Admin\AppData\Local\Temp\7332.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\73AF.tmp"C:\Users\Admin\AppData\Local\Temp\73AF.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\742C.tmp"C:\Users\Admin\AppData\Local\Temp\742C.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\749A.tmp"C:\Users\Admin\AppData\Local\Temp\749A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\7507.tmp"C:\Users\Admin\AppData\Local\Temp\7507.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\7565.tmp"C:\Users\Admin\AppData\Local\Temp\7565.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\75D2.tmp"C:\Users\Admin\AppData\Local\Temp\75D2.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\7640.tmp"C:\Users\Admin\AppData\Local\Temp\7640.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\76AD.tmp"C:\Users\Admin\AppData\Local\Temp\76AD.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\771A.tmp"C:\Users\Admin\AppData\Local\Temp\771A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\7778.tmp"C:\Users\Admin\AppData\Local\Temp\7778.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\77D6.tmp"C:\Users\Admin\AppData\Local\Temp\77D6.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\7834.tmp"C:\Users\Admin\AppData\Local\Temp\7834.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\78A1.tmp"C:\Users\Admin\AppData\Local\Temp\78A1.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\78FF.tmp"C:\Users\Admin\AppData\Local\Temp\78FF.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\795C.tmp"C:\Users\Admin\AppData\Local\Temp\795C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\79CA.tmp"C:\Users\Admin\AppData\Local\Temp\79CA.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\7A28.tmp"C:\Users\Admin\AppData\Local\Temp\7A28.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\7A95.tmp"C:\Users\Admin\AppData\Local\Temp\7A95.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\7AF3.tmp"C:\Users\Admin\AppData\Local\Temp\7AF3.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\7B50.tmp"C:\Users\Admin\AppData\Local\Temp\7B50.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\7BAE.tmp"C:\Users\Admin\AppData\Local\Temp\7BAE.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\7CC7.tmp"C:\Users\Admin\AppData\Local\Temp\7CC7.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\7D25.tmp"C:\Users\Admin\AppData\Local\Temp\7D25.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\7DC1.tmp"C:\Users\Admin\AppData\Local\Temp\7DC1.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\7E6D.tmp"C:\Users\Admin\AppData\Local\Temp\7E6D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\7EEA.tmp"C:\Users\Admin\AppData\Local\Temp\7EEA.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\7F67.tmp"C:\Users\Admin\AppData\Local\Temp\7F67.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"C:\Users\Admin\AppData\Local\Temp\7FE4.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\8061.tmp"C:\Users\Admin\AppData\Local\Temp\8061.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\80DE.tmp"C:\Users\Admin\AppData\Local\Temp\80DE.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\815B.tmp"C:\Users\Admin\AppData\Local\Temp\815B.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\81D8.tmp"C:\Users\Admin\AppData\Local\Temp\81D8.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\8255.tmp"C:\Users\Admin\AppData\Local\Temp\8255.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\8301.tmp"C:\Users\Admin\AppData\Local\Temp\8301.tmp"65⤵
- Executes dropped EXE
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\836F.tmp"C:\Users\Admin\AppData\Local\Temp\836F.tmp"66⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\83EC.tmp"C:\Users\Admin\AppData\Local\Temp\83EC.tmp"67⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\8469.tmp"C:\Users\Admin\AppData\Local\Temp\8469.tmp"68⤵PID:6064
-
C:\Users\Admin\AppData\Local\Temp\84F5.tmp"C:\Users\Admin\AppData\Local\Temp\84F5.tmp"69⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\8563.tmp"C:\Users\Admin\AppData\Local\Temp\8563.tmp"70⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\85EF.tmp"C:\Users\Admin\AppData\Local\Temp\85EF.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\867C.tmp"C:\Users\Admin\AppData\Local\Temp\867C.tmp"72⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\86E9.tmp"C:\Users\Admin\AppData\Local\Temp\86E9.tmp"73⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\8776.tmp"C:\Users\Admin\AppData\Local\Temp\8776.tmp"74⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\8822.tmp"C:\Users\Admin\AppData\Local\Temp\8822.tmp"75⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\889F.tmp"C:\Users\Admin\AppData\Local\Temp\889F.tmp"76⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\891C.tmp"C:\Users\Admin\AppData\Local\Temp\891C.tmp"77⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\8999.tmp"C:\Users\Admin\AppData\Local\Temp\8999.tmp"78⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\8A25.tmp"C:\Users\Admin\AppData\Local\Temp\8A25.tmp"79⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\8AA2.tmp"C:\Users\Admin\AppData\Local\Temp\8AA2.tmp"80⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\8B10.tmp"C:\Users\Admin\AppData\Local\Temp\8B10.tmp"81⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"C:\Users\Admin\AppData\Local\Temp\8B8D.tmp"82⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"83⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\8C77.tmp"C:\Users\Admin\AppData\Local\Temp\8C77.tmp"84⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\8D04.tmp"C:\Users\Admin\AppData\Local\Temp\8D04.tmp"85⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"86⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"C:\Users\Admin\AppData\Local\Temp\8E4C.tmp"87⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\8EC9.tmp"C:\Users\Admin\AppData\Local\Temp\8EC9.tmp"88⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\8F65.tmp"C:\Users\Admin\AppData\Local\Temp\8F65.tmp"89⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\906F.tmp"C:\Users\Admin\AppData\Local\Temp\906F.tmp"90⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\910B.tmp"C:\Users\Admin\AppData\Local\Temp\910B.tmp"91⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\9198.tmp"C:\Users\Admin\AppData\Local\Temp\9198.tmp"92⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\9215.tmp"C:\Users\Admin\AppData\Local\Temp\9215.tmp"93⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\92A1.tmp"C:\Users\Admin\AppData\Local\Temp\92A1.tmp"94⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\933D.tmp"C:\Users\Admin\AppData\Local\Temp\933D.tmp"95⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\93DA.tmp"C:\Users\Admin\AppData\Local\Temp\93DA.tmp"96⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\9457.tmp"C:\Users\Admin\AppData\Local\Temp\9457.tmp"97⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\9503.tmp"C:\Users\Admin\AppData\Local\Temp\9503.tmp"98⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\9580.tmp"C:\Users\Admin\AppData\Local\Temp\9580.tmp"99⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\962B.tmp"C:\Users\Admin\AppData\Local\Temp\962B.tmp"100⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\96B8.tmp"C:\Users\Admin\AppData\Local\Temp\96B8.tmp"101⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\9745.tmp"C:\Users\Admin\AppData\Local\Temp\9745.tmp"102⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\97F1.tmp"C:\Users\Admin\AppData\Local\Temp\97F1.tmp"103⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\987D.tmp"C:\Users\Admin\AppData\Local\Temp\987D.tmp"104⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\98EB.tmp"C:\Users\Admin\AppData\Local\Temp\98EB.tmp"105⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\9996.tmp"C:\Users\Admin\AppData\Local\Temp\9996.tmp"106⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\9A62.tmp"C:\Users\Admin\AppData\Local\Temp\9A62.tmp"107⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\9B1D.tmp"C:\Users\Admin\AppData\Local\Temp\9B1D.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\9BAA.tmp"C:\Users\Admin\AppData\Local\Temp\9BAA.tmp"109⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\9C27.tmp"C:\Users\Admin\AppData\Local\Temp\9C27.tmp"110⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\9CC3.tmp"C:\Users\Admin\AppData\Local\Temp\9CC3.tmp"111⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\9D6F.tmp"C:\Users\Admin\AppData\Local\Temp\9D6F.tmp"112⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\9E0B.tmp"C:\Users\Admin\AppData\Local\Temp\9E0B.tmp"113⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\9E98.tmp"C:\Users\Admin\AppData\Local\Temp\9E98.tmp"114⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\9F24.tmp"C:\Users\Admin\AppData\Local\Temp\9F24.tmp"115⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\9FC1.tmp"C:\Users\Admin\AppData\Local\Temp\9FC1.tmp"116⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\A06C.tmp"C:\Users\Admin\AppData\Local\Temp\A06C.tmp"117⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\A147.tmp"C:\Users\Admin\AppData\Local\Temp\A147.tmp"118⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"C:\Users\Admin\AppData\Local\Temp\A1F3.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\A29F.tmp"C:\Users\Admin\AppData\Local\Temp\A29F.tmp"120⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\A33B.tmp"C:\Users\Admin\AppData\Local\Temp\A33B.tmp"121⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\A3E7.tmp"C:\Users\Admin\AppData\Local\Temp\A3E7.tmp"122⤵PID:2832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-