Analysis
- max time kernel
121s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 14:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_0ef90d9cd57d41132987f5c299cfacbe_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_0ef90d9cd57d41132987f5c299cfacbe_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-09_0ef90d9cd57d41132987f5c299cfacbe_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260809-saqw5sgp91
- SHA256 0b09ca339c99e5869fffad0d8f12b965dee2649795c6226a21821f7e0c59768d
- MD5 0ef90d9cd57d41132987f5c299cfacbe
- SHA1 1b3d96aa89efbcf3d3ca266d993b786726d19366
- SHA512 33bc2abdcd0dc2a4e878d443811a9a16b91dc435ad30375de5ad991010f9b072cf523f1a07272d66f5612fb7e6c63815804ab7a0673e4c977ad2c91393e49e0b
- SSDEEP 12288:NU5rCOTeijIAM0XCIaZfsaQ7B3f/TZwlH:NUQOJjIB0XysZ7BnTSlH
- TLSH T18EB4F125B684C232E29202710AE6DBB2693ABD35572654C73BC4677E2FB57E1E334307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4164 4A4E.tmp 2844 4B19.tmp 1104 4BF3.tmp 4748 4DB9.tmp 5564 4E64.tmp 3108 4F01.tmp 2852 4FDB.tmp 3132 5078.tmp 4732 5133.tmp 1364 51FE.tmp 1384 529B.tmp 256 5385.tmp 5804 5440.tmp 1156 54CD.tmp 1556 5598.tmp 3840 5673.tmp 1508 573E.tmp 3968 57DA.tmp 2056 58C5.tmp 5604 59AF.tmp 5520 5AA9.tmp 4788 5B74.tmp 1840 5C4F.tmp 5624 5D0A.tmp 2316 5E04.tmp 3728 5EDF.tmp 4308 5FBA.tmp 3976 60A4.tmp 2948 617F.tmp 1248 623B.tmp 1200 6335.tmp 476 640F.tmp 4284 64DA.tmp 6108 6586.tmp 3220 6632.tmp 2444 66BF.tmp 4488 678A.tmp 5828 6845.tmp 2820 68C2.tmp 2396 694F.tmp 3432 69DC.tmp 4268 6A78.tmp 4628 6B24.tmp 4324 6BC0.tmp 3300 6C5C.tmp 2836 6CD9.tmp 5504 6DB4.tmp 4636 6E60.tmp 5740 6F0C.tmp 3088 6FA8.tmp 3788 7054.tmp 4972 710F.tmp 4292 719C.tmp 5776 7229.tmp 2280 72A6.tmp 5024 7361.tmp 4924 740D.tmp 4816 748A.tmp 4456 7546.tmp 6040 75F1.tmp 4336 76AD.tmp 5488 773A.tmp 5492 77D6.tmp 2616 7882.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A54A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F926.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8687.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A927.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A308.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 128F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3058.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1123.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 123C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2089.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 834B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7159.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A912.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B95E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8728.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8483.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 963.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5286.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3876.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E6F.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1492 wrote to memory of 4164 1492 2026-08-09_0ef90d9cd57d41132987f5c299cfacbe_elex_mafia_stealc_tofsee.exe 88 PID 4164 wrote to memory of 2844 4164 4A4E.tmp 90 PID 2844 wrote to memory of 1104 2844 4B19.tmp 91 PID 1104 wrote to memory of 4748 1104 4BF3.tmp 92 PID 4748 wrote to memory of 5564 4748 4DB9.tmp 93 PID 5564 wrote to memory of 3108 5564 4E64.tmp 94 PID 3108 wrote to memory of 2852 3108 4F01.tmp 95 PID 2852 wrote to memory of 3132 2852 4FDB.tmp 96 PID 3132 wrote to memory of 4732 3132 5078.tmp 97 PID 4732 wrote to memory of 1364 4732 5133.tmp 98 PID 1364 wrote to memory of 1384 1364 51FE.tmp 99 PID 1384 wrote to memory of 256 1384 529B.tmp 100 PID 256 wrote to memory of 5804 256 5385.tmp 101 PID 5804 wrote to memory of 1156 5804 5440.tmp 102 PID 1156 wrote to memory of 1556 1156 54CD.tmp 103 PID 1556 wrote to memory of 3840 1556 5598.tmp 104 PID 3840 wrote to memory of 1508 3840 5673.tmp 105 PID 1508 wrote to memory of 3968 1508 573E.tmp 106 PID 3968 wrote to memory of 2056 3968 57DA.tmp 107 PID 2056 wrote to memory of 5604 2056 58C5.tmp 108 PID 5604 wrote to memory of 5520 5604 59AF.tmp 109 PID 5520 wrote to memory of 4788 5520 5AA9.tmp 110 PID 4788 wrote to memory of 1840 4788 5B74.tmp 111 PID 1840 wrote to memory of 5624 1840 5C4F.tmp 112 PID 5624 wrote to memory of 2316 5624 5D0A.tmp 113 PID 2316 wrote to memory of 3728 2316 5E04.tmp 114 PID 3728 wrote to memory of 4308 3728 5EDF.tmp 115 PID 4308 wrote to memory of 3976 4308 5FBA.tmp 116 PID 3976 wrote to memory of 2948 3976 60A4.tmp 117 PID 2948 wrote to memory of 1248 2948 617F.tmp 118 PID 1248 wrote to memory of 1200 1248 623B.tmp 119 PID 1200 wrote to memory of 476 1200 6335.tmp 120 PID 476 wrote to memory of 4284 476 640F.tmp 121 PID 4284 wrote to memory of 6108 4284 64DA.tmp 122 PID 6108 wrote to memory of 3220 6108 6586.tmp 123 PID 3220 wrote to memory of 2444 3220 6632.tmp 124 PID 2444 wrote to memory of 4488 2444 66BF.tmp 125 PID 4488 wrote to memory of 5828 4488 678A.tmp 126 PID 5828 wrote to memory of 2820 5828 6845.tmp 127 PID 2820 wrote to memory of 2396 2820 68C2.tmp 128 PID 2396 wrote to memory of 3432 2396 694F.tmp 129 PID 3432 wrote to memory of 4268 3432 69DC.tmp 130 PID 4268 wrote to memory of 4628 4268 6A78.tmp 131 PID 4628 wrote to memory of 4324 4628 6B24.tmp 132 PID 4324 wrote to memory of 3300 4324 6BC0.tmp 133 PID 3300 wrote to memory of 2836 3300 6C5C.tmp 134 PID 2836 wrote to memory of 5504 2836 6CD9.tmp 135 PID 5504 wrote to memory of 4636 5504 6DB4.tmp 136 PID 4636 wrote to memory of 5740 4636 6E60.tmp 137 PID 5740 wrote to memory of 3088 5740 6F0C.tmp 138 PID 3088 wrote to memory of 3788 3088 6FA8.tmp 139 PID 3788 wrote to memory of 4972 3788 7054.tmp 140 PID 4972 wrote to memory of 4292 4972 710F.tmp 141 PID 4292 wrote to memory of 5776 4292 719C.tmp 142 PID 5776 wrote to memory of 2280 5776 7229.tmp 143 PID 2280 wrote to memory of 5024 2280 72A6.tmp 144 PID 5024 wrote to memory of 4924 5024 7361.tmp 145 PID 4924 wrote to memory of 4816 4924 740D.tmp 146 PID 4816 wrote to memory of 4456 4816 748A.tmp 147 PID 4456 wrote to memory of 6040 4456 7546.tmp 148 PID 6040 wrote to memory of 4336 6040 75F1.tmp 149 PID 4336 wrote to memory of 5488 4336 76AD.tmp 150 PID 5488 wrote to memory of 5492 5488 773A.tmp 151 PID 5492 wrote to memory of 2616 5492 77D6.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_0ef90d9cd57d41132987f5c299cfacbe_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_0ef90d9cd57d41132987f5c299cfacbe_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\4A4E.tmp"C:\Users\Admin\AppData\Local\Temp\4A4E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\4B19.tmp"C:\Users\Admin\AppData\Local\Temp\4B19.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\4BF3.tmp"C:\Users\Admin\AppData\Local\Temp\4BF3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\4DB9.tmp"C:\Users\Admin\AppData\Local\Temp\4DB9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\4E64.tmp"C:\Users\Admin\AppData\Local\Temp\4E64.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\4F01.tmp"C:\Users\Admin\AppData\Local\Temp\4F01.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\4FDB.tmp"C:\Users\Admin\AppData\Local\Temp\4FDB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\5078.tmp"C:\Users\Admin\AppData\Local\Temp\5078.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\5133.tmp"C:\Users\Admin\AppData\Local\Temp\5133.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\51FE.tmp"C:\Users\Admin\AppData\Local\Temp\51FE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\529B.tmp"C:\Users\Admin\AppData\Local\Temp\529B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\5385.tmp"C:\Users\Admin\AppData\Local\Temp\5385.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\5440.tmp"C:\Users\Admin\AppData\Local\Temp\5440.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\54CD.tmp"C:\Users\Admin\AppData\Local\Temp\54CD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\5598.tmp"C:\Users\Admin\AppData\Local\Temp\5598.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\5673.tmp"C:\Users\Admin\AppData\Local\Temp\5673.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\573E.tmp"C:\Users\Admin\AppData\Local\Temp\573E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\57DA.tmp"C:\Users\Admin\AppData\Local\Temp\57DA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\58C5.tmp"C:\Users\Admin\AppData\Local\Temp\58C5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\59AF.tmp"C:\Users\Admin\AppData\Local\Temp\59AF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5604 -
C:\Users\Admin\AppData\Local\Temp\5AA9.tmp"C:\Users\Admin\AppData\Local\Temp\5AA9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Users\Admin\AppData\Local\Temp\5B74.tmp"C:\Users\Admin\AppData\Local\Temp\5B74.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\5C4F.tmp"C:\Users\Admin\AppData\Local\Temp\5C4F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\5D0A.tmp"C:\Users\Admin\AppData\Local\Temp\5D0A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\5E04.tmp"C:\Users\Admin\AppData\Local\Temp\5E04.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\5EDF.tmp"C:\Users\Admin\AppData\Local\Temp\5EDF.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\5FBA.tmp"C:\Users\Admin\AppData\Local\Temp\5FBA.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\60A4.tmp"C:\Users\Admin\AppData\Local\Temp\60A4.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\617F.tmp"C:\Users\Admin\AppData\Local\Temp\617F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\623B.tmp"C:\Users\Admin\AppData\Local\Temp\623B.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\6335.tmp"C:\Users\Admin\AppData\Local\Temp\6335.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\640F.tmp"C:\Users\Admin\AppData\Local\Temp\640F.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Users\Admin\AppData\Local\Temp\64DA.tmp"C:\Users\Admin\AppData\Local\Temp\64DA.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\6586.tmp"C:\Users\Admin\AppData\Local\Temp\6586.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\6632.tmp"C:\Users\Admin\AppData\Local\Temp\6632.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\66BF.tmp"C:\Users\Admin\AppData\Local\Temp\66BF.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\678A.tmp"C:\Users\Admin\AppData\Local\Temp\678A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\6845.tmp"C:\Users\Admin\AppData\Local\Temp\6845.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\68C2.tmp"C:\Users\Admin\AppData\Local\Temp\68C2.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\694F.tmp"C:\Users\Admin\AppData\Local\Temp\694F.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\69DC.tmp"C:\Users\Admin\AppData\Local\Temp\69DC.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\6A78.tmp"C:\Users\Admin\AppData\Local\Temp\6A78.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\6B24.tmp"C:\Users\Admin\AppData\Local\Temp\6B24.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\6BC0.tmp"C:\Users\Admin\AppData\Local\Temp\6BC0.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\6C5C.tmp"C:\Users\Admin\AppData\Local\Temp\6C5C.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\6CD9.tmp"C:\Users\Admin\AppData\Local\Temp\6CD9.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\6E60.tmp"C:\Users\Admin\AppData\Local\Temp\6E60.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\6F0C.tmp"C:\Users\Admin\AppData\Local\Temp\6F0C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\6FA8.tmp"C:\Users\Admin\AppData\Local\Temp\6FA8.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\7054.tmp"C:\Users\Admin\AppData\Local\Temp\7054.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\710F.tmp"C:\Users\Admin\AppData\Local\Temp\710F.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\719C.tmp"C:\Users\Admin\AppData\Local\Temp\719C.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\7229.tmp"C:\Users\Admin\AppData\Local\Temp\7229.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\72A6.tmp"C:\Users\Admin\AppData\Local\Temp\72A6.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\7361.tmp"C:\Users\Admin\AppData\Local\Temp\7361.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\740D.tmp"C:\Users\Admin\AppData\Local\Temp\740D.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\748A.tmp"C:\Users\Admin\AppData\Local\Temp\748A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\7546.tmp"C:\Users\Admin\AppData\Local\Temp\7546.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\75F1.tmp"C:\Users\Admin\AppData\Local\Temp\75F1.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Users\Admin\AppData\Local\Temp\76AD.tmp"C:\Users\Admin\AppData\Local\Temp\76AD.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\773A.tmp"C:\Users\Admin\AppData\Local\Temp\773A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\77D6.tmp"C:\Users\Admin\AppData\Local\Temp\77D6.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\7882.tmp"C:\Users\Admin\AppData\Local\Temp\7882.tmp"65⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\793D.tmp"C:\Users\Admin\AppData\Local\Temp\793D.tmp"66⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\79D9.tmp"C:\Users\Admin\AppData\Local\Temp\79D9.tmp"67⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\7A76.tmp"C:\Users\Admin\AppData\Local\Temp\7A76.tmp"68⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\7AF3.tmp"C:\Users\Admin\AppData\Local\Temp\7AF3.tmp"69⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\7B8F.tmp"C:\Users\Admin\AppData\Local\Temp\7B8F.tmp"70⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"C:\Users\Admin\AppData\Local\Temp\7C0C.tmp"71⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\7C99.tmp"C:\Users\Admin\AppData\Local\Temp\7C99.tmp"72⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\7D35.tmp"C:\Users\Admin\AppData\Local\Temp\7D35.tmp"73⤵PID:6080
-
C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"74⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\7E3E.tmp"C:\Users\Admin\AppData\Local\Temp\7E3E.tmp"75⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\7EFA.tmp"C:\Users\Admin\AppData\Local\Temp\7EFA.tmp"76⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\7F87.tmp"C:\Users\Admin\AppData\Local\Temp\7F87.tmp"77⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\8004.tmp"C:\Users\Admin\AppData\Local\Temp\8004.tmp"78⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\8090.tmp"C:\Users\Admin\AppData\Local\Temp\8090.tmp"79⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\810D.tmp"C:\Users\Admin\AppData\Local\Temp\810D.tmp"80⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\819A.tmp"C:\Users\Admin\AppData\Local\Temp\819A.tmp"81⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\8236.tmp"C:\Users\Admin\AppData\Local\Temp\8236.tmp"82⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\82E2.tmp"C:\Users\Admin\AppData\Local\Temp\82E2.tmp"83⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\834F.tmp"C:\Users\Admin\AppData\Local\Temp\834F.tmp"84⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\83DC.tmp"C:\Users\Admin\AppData\Local\Temp\83DC.tmp"85⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\8469.tmp"C:\Users\Admin\AppData\Local\Temp\8469.tmp"86⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\84E6.tmp"C:\Users\Admin\AppData\Local\Temp\84E6.tmp"87⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\8572.tmp"C:\Users\Admin\AppData\Local\Temp\8572.tmp"88⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\85FF.tmp"C:\Users\Admin\AppData\Local\Temp\85FF.tmp"89⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\868B.tmp"C:\Users\Admin\AppData\Local\Temp\868B.tmp"90⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\8728.tmp"C:\Users\Admin\AppData\Local\Temp\8728.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\87E3.tmp"C:\Users\Admin\AppData\Local\Temp\87E3.tmp"92⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\8860.tmp"C:\Users\Admin\AppData\Local\Temp\8860.tmp"93⤵PID:5688
-
C:\Users\Admin\AppData\Local\Temp\88FC.tmp"C:\Users\Admin\AppData\Local\Temp\88FC.tmp"94⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\8999.tmp"C:\Users\Admin\AppData\Local\Temp\8999.tmp"95⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\8A25.tmp"C:\Users\Admin\AppData\Local\Temp\8A25.tmp"96⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\8AB2.tmp"C:\Users\Admin\AppData\Local\Temp\8AB2.tmp"97⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"98⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"99⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"100⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\8D33.tmp"C:\Users\Admin\AppData\Local\Temp\8D33.tmp"101⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"C:\Users\Admin\AppData\Local\Temp\8DCF.tmp"102⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\8E8A.tmp"C:\Users\Admin\AppData\Local\Temp\8E8A.tmp"103⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\8F36.tmp"C:\Users\Admin\AppData\Local\Temp\8F36.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\8FB3.tmp"C:\Users\Admin\AppData\Local\Temp\8FB3.tmp"105⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\907E.tmp"C:\Users\Admin\AppData\Local\Temp\907E.tmp"106⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\912A.tmp"C:\Users\Admin\AppData\Local\Temp\912A.tmp"107⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\91D6.tmp"C:\Users\Admin\AppData\Local\Temp\91D6.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\9263.tmp"C:\Users\Admin\AppData\Local\Temp\9263.tmp"109⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\92E0.tmp"C:\Users\Admin\AppData\Local\Temp\92E0.tmp"110⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\937C.tmp"C:\Users\Admin\AppData\Local\Temp\937C.tmp"111⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\93F9.tmp"C:\Users\Admin\AppData\Local\Temp\93F9.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\9486.tmp"C:\Users\Admin\AppData\Local\Temp\9486.tmp"113⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\9522.tmp"C:\Users\Admin\AppData\Local\Temp\9522.tmp"114⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\95BE.tmp"C:\Users\Admin\AppData\Local\Temp\95BE.tmp"115⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\964B.tmp"C:\Users\Admin\AppData\Local\Temp\964B.tmp"116⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\96D7.tmp"C:\Users\Admin\AppData\Local\Temp\96D7.tmp"117⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\9783.tmp"C:\Users\Admin\AppData\Local\Temp\9783.tmp"118⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\9810.tmp"C:\Users\Admin\AppData\Local\Temp\9810.tmp"119⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\98BC.tmp"C:\Users\Admin\AppData\Local\Temp\98BC.tmp"120⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\9968.tmp"C:\Users\Admin\AppData\Local\Temp\9968.tmp"121⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\9A04.tmp"C:\Users\Admin\AppData\Local\Temp\9A04.tmp"122⤵PID:3472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-