Analysis
- max time kernel
120s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 03:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-11_07c03c6193fa294e59bccd458e95afc1_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_07c03c6193fa294e59bccd458e95afc1_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-11_07c03c6193fa294e59bccd458e95afc1_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260811-ejba6a1tfs
- SHA256 e0dfbaec9ea6e9834a5ce50722c7cb6397d7b35f1a1954062a1845d5030915cd
- MD5 07c03c6193fa294e59bccd458e95afc1
- SHA1 ba6e6b277eec8358c8c6e81fa94ac84efdcfd948
- SHA512 f8145dc576ccbf3ea351fafdc438016848746589755beba6eec6a8aee58a4054abd092adc8dad92582227cb8f19ad5b35db274d288f4fc2fae07156f08b018ec
- SSDEEP 12288:NU5rCOTeijdTuNp2bwDdBCl27DhytrbATZwlH:NUQOJjBuNpn0E3MJATSlH
- TLSH T104B4F025B184C133E59201710BEAEBB26A3BBC754722A4C32794677E2FB52E1E375307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4072 1C68.tmp 4900 1E4C.tmp 4216 1F36.tmp 3408 2001.tmp 4388 20DC.tmp 3572 21B7.tmp 1648 2272.tmp 1060 235D.tmp 5732 2447.tmp 2348 2512.tmp 5656 259F.tmp 3744 267A.tmp 5040 2754.tmp 4340 2820.tmp 1840 28BC.tmp 5884 2948.tmp 6032 29E5.tmp 2424 2AB0.tmp 4276 2B7B.tmp 2784 2C17.tmp 248 2C94.tmp 564 2D5F.tmp 1240 2DFC.tmp 1612 2EA7.tmp 3404 2F63.tmp 3588 303E.tmp 5004 30EA.tmp 2228 3167.tmp 2000 3241.tmp 4608 32FD.tmp 4404 3399.tmp 1628 3445.tmp 3052 3510.tmp 2972 359D.tmp 3244 361A.tmp 1524 36B6.tmp 5836 3723.tmp 804 37C0.tmp 2484 383D.tmp 1064 38BA.tmp 3852 3927.tmp 3416 39A4.tmp 4896 3A21.tmp 1376 3AAE.tmp 4708 3B2B.tmp 5932 3BA8.tmp 1396 3C25.tmp 4600 3CA2.tmp 2088 3D0F.tmp 4624 3D8C.tmp 696 3E19.tmp 1800 3EC4.tmp 4184 3F51.tmp 4088 3FDE.tmp 1924 407A.tmp 684 40F7.tmp 3652 4164.tmp 3888 4201.tmp 5360 428D.tmp 5744 430A.tmp 6112 43B6.tmp 1448 4423.tmp 2008 44A0.tmp 4936 452D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9706.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 828F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D478.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9627.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2754.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 303E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9919.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 551.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7759.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D24A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A60A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 676B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E262.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E37C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4144 wrote to memory of 4072 4144 2026-08-11_07c03c6193fa294e59bccd458e95afc1_elex_mafia_stealc_tofsee.exe 89 PID 4072 wrote to memory of 4900 4072 1C68.tmp 90 PID 4900 wrote to memory of 4216 4900 1E4C.tmp 91 PID 4216 wrote to memory of 3408 4216 1F36.tmp 92 PID 3408 wrote to memory of 4388 3408 2001.tmp 93 PID 4388 wrote to memory of 3572 4388 20DC.tmp 94 PID 3572 wrote to memory of 1648 3572 21B7.tmp 95 PID 1648 wrote to memory of 1060 1648 2272.tmp 96 PID 1060 wrote to memory of 5732 1060 235D.tmp 97 PID 5732 wrote to memory of 2348 5732 2447.tmp 98 PID 2348 wrote to memory of 5656 2348 2512.tmp 99 PID 5656 wrote to memory of 3744 5656 259F.tmp 100 PID 3744 wrote to memory of 5040 3744 267A.tmp 101 PID 5040 wrote to memory of 4340 5040 2754.tmp 102 PID 4340 wrote to memory of 1840 4340 2820.tmp 103 PID 1840 wrote to memory of 5884 1840 28BC.tmp 104 PID 5884 wrote to memory of 6032 5884 2948.tmp 105 PID 6032 wrote to memory of 2424 6032 29E5.tmp 106 PID 2424 wrote to memory of 4276 2424 2AB0.tmp 107 PID 4276 wrote to memory of 2784 4276 2B7B.tmp 108 PID 2784 wrote to memory of 248 2784 2C17.tmp 109 PID 248 wrote to memory of 564 248 2C94.tmp 110 PID 564 wrote to memory of 1240 564 2D5F.tmp 111 PID 1240 wrote to memory of 1612 1240 2DFC.tmp 112 PID 1612 wrote to memory of 3404 1612 2EA7.tmp 113 PID 3404 wrote to memory of 3588 3404 2F63.tmp 114 PID 3588 wrote to memory of 5004 3588 303E.tmp 115 PID 5004 wrote to memory of 2228 5004 30EA.tmp 116 PID 2228 wrote to memory of 2000 2228 3167.tmp 117 PID 2000 wrote to memory of 4608 2000 3241.tmp 118 PID 4608 wrote to memory of 4404 4608 32FD.tmp 119 PID 4404 wrote to memory of 1628 4404 3399.tmp 120 PID 1628 wrote to memory of 3052 1628 3445.tmp 121 PID 3052 wrote to memory of 2972 3052 3510.tmp 122 PID 2972 wrote to memory of 3244 2972 359D.tmp 123 PID 3244 wrote to memory of 1524 3244 361A.tmp 124 PID 1524 wrote to memory of 5836 1524 36B6.tmp 125 PID 5836 wrote to memory of 804 5836 3723.tmp 126 PID 804 wrote to memory of 2484 804 37C0.tmp 127 PID 2484 wrote to memory of 1064 2484 383D.tmp 128 PID 1064 wrote to memory of 3852 1064 38BA.tmp 129 PID 3852 wrote to memory of 3416 3852 3927.tmp 130 PID 3416 wrote to memory of 4896 3416 39A4.tmp 131 PID 4896 wrote to memory of 1376 4896 3A21.tmp 132 PID 1376 wrote to memory of 4708 1376 3AAE.tmp 133 PID 4708 wrote to memory of 5932 4708 3B2B.tmp 134 PID 5932 wrote to memory of 1396 5932 3BA8.tmp 135 PID 1396 wrote to memory of 4600 1396 3C25.tmp 136 PID 4600 wrote to memory of 2088 4600 3CA2.tmp 137 PID 2088 wrote to memory of 4624 2088 3D0F.tmp 138 PID 4624 wrote to memory of 696 4624 3D8C.tmp 139 PID 696 wrote to memory of 1800 696 3E19.tmp 140 PID 1800 wrote to memory of 4184 1800 3EC4.tmp 141 PID 4184 wrote to memory of 4088 4184 3F51.tmp 142 PID 4088 wrote to memory of 1924 4088 3FDE.tmp 143 PID 1924 wrote to memory of 684 1924 407A.tmp 144 PID 684 wrote to memory of 3652 684 40F7.tmp 145 PID 3652 wrote to memory of 3888 3652 4164.tmp 146 PID 3888 wrote to memory of 5360 3888 4201.tmp 147 PID 5360 wrote to memory of 5744 5360 428D.tmp 148 PID 5744 wrote to memory of 6112 5744 430A.tmp 149 PID 6112 wrote to memory of 1448 6112 43B6.tmp 150 PID 1448 wrote to memory of 2008 1448 4423.tmp 151 PID 2008 wrote to memory of 4936 2008 44A0.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_07c03c6193fa294e59bccd458e95afc1_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_07c03c6193fa294e59bccd458e95afc1_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\1C68.tmp"C:\Users\Admin\AppData\Local\Temp\1C68.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\1E4C.tmp"C:\Users\Admin\AppData\Local\Temp\1E4C.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\1F36.tmp"C:\Users\Admin\AppData\Local\Temp\1F36.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\2001.tmp"C:\Users\Admin\AppData\Local\Temp\2001.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\20DC.tmp"C:\Users\Admin\AppData\Local\Temp\20DC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\21B7.tmp"C:\Users\Admin\AppData\Local\Temp\21B7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\2272.tmp"C:\Users\Admin\AppData\Local\Temp\2272.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\235D.tmp"C:\Users\Admin\AppData\Local\Temp\235D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\2447.tmp"C:\Users\Admin\AppData\Local\Temp\2447.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5732 -
C:\Users\Admin\AppData\Local\Temp\2512.tmp"C:\Users\Admin\AppData\Local\Temp\2512.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\259F.tmp"C:\Users\Admin\AppData\Local\Temp\259F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\267A.tmp"C:\Users\Admin\AppData\Local\Temp\267A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\2754.tmp"C:\Users\Admin\AppData\Local\Temp\2754.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\2820.tmp"C:\Users\Admin\AppData\Local\Temp\2820.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\28BC.tmp"C:\Users\Admin\AppData\Local\Temp\28BC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\2948.tmp"C:\Users\Admin\AppData\Local\Temp\2948.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\29E5.tmp"C:\Users\Admin\AppData\Local\Temp\29E5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\2AB0.tmp"C:\Users\Admin\AppData\Local\Temp\2AB0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\2B7B.tmp"C:\Users\Admin\AppData\Local\Temp\2B7B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\2C17.tmp"C:\Users\Admin\AppData\Local\Temp\2C17.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\2C94.tmp"C:\Users\Admin\AppData\Local\Temp\2C94.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Users\Admin\AppData\Local\Temp\2D5F.tmp"C:\Users\Admin\AppData\Local\Temp\2D5F.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\2DFC.tmp"C:\Users\Admin\AppData\Local\Temp\2DFC.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\2EA7.tmp"C:\Users\Admin\AppData\Local\Temp\2EA7.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\2F63.tmp"C:\Users\Admin\AppData\Local\Temp\2F63.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\303E.tmp"C:\Users\Admin\AppData\Local\Temp\303E.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\30EA.tmp"C:\Users\Admin\AppData\Local\Temp\30EA.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\3167.tmp"C:\Users\Admin\AppData\Local\Temp\3167.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\3241.tmp"C:\Users\Admin\AppData\Local\Temp\3241.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\32FD.tmp"C:\Users\Admin\AppData\Local\Temp\32FD.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\3399.tmp"C:\Users\Admin\AppData\Local\Temp\3399.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\3445.tmp"C:\Users\Admin\AppData\Local\Temp\3445.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\3510.tmp"C:\Users\Admin\AppData\Local\Temp\3510.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\359D.tmp"C:\Users\Admin\AppData\Local\Temp\359D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\361A.tmp"C:\Users\Admin\AppData\Local\Temp\361A.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\36B6.tmp"C:\Users\Admin\AppData\Local\Temp\36B6.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\3723.tmp"C:\Users\Admin\AppData\Local\Temp\3723.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\37C0.tmp"C:\Users\Admin\AppData\Local\Temp\37C0.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\383D.tmp"C:\Users\Admin\AppData\Local\Temp\383D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\38BA.tmp"C:\Users\Admin\AppData\Local\Temp\38BA.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\3927.tmp"C:\Users\Admin\AppData\Local\Temp\3927.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\39A4.tmp"C:\Users\Admin\AppData\Local\Temp\39A4.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\3A21.tmp"C:\Users\Admin\AppData\Local\Temp\3A21.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"C:\Users\Admin\AppData\Local\Temp\3AAE.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"C:\Users\Admin\AppData\Local\Temp\3B2B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\3BA8.tmp"C:\Users\Admin\AppData\Local\Temp\3BA8.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\3C25.tmp"C:\Users\Admin\AppData\Local\Temp\3C25.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\3CA2.tmp"C:\Users\Admin\AppData\Local\Temp\3CA2.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\3D0F.tmp"C:\Users\Admin\AppData\Local\Temp\3D0F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\3D8C.tmp"C:\Users\Admin\AppData\Local\Temp\3D8C.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\3EC4.tmp"C:\Users\Admin\AppData\Local\Temp\3EC4.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\40F7.tmp"C:\Users\Admin\AppData\Local\Temp\40F7.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\4201.tmp"C:\Users\Admin\AppData\Local\Temp\4201.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\428D.tmp"C:\Users\Admin\AppData\Local\Temp\428D.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\430A.tmp"C:\Users\Admin\AppData\Local\Temp\430A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\43B6.tmp"C:\Users\Admin\AppData\Local\Temp\43B6.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\4423.tmp"C:\Users\Admin\AppData\Local\Temp\4423.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\44A0.tmp"C:\Users\Admin\AppData\Local\Temp\44A0.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\452D.tmp"C:\Users\Admin\AppData\Local\Temp\452D.tmp"65⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\45BA.tmp"C:\Users\Admin\AppData\Local\Temp\45BA.tmp"66⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\4637.tmp"C:\Users\Admin\AppData\Local\Temp\4637.tmp"67⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\46C3.tmp"C:\Users\Admin\AppData\Local\Temp\46C3.tmp"68⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\4731.tmp"C:\Users\Admin\AppData\Local\Temp\4731.tmp"69⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\479E.tmp"C:\Users\Admin\AppData\Local\Temp\479E.tmp"70⤵PID:5780
-
C:\Users\Admin\AppData\Local\Temp\482B.tmp"C:\Users\Admin\AppData\Local\Temp\482B.tmp"71⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\48A8.tmp"C:\Users\Admin\AppData\Local\Temp\48A8.tmp"72⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\4934.tmp"C:\Users\Admin\AppData\Local\Temp\4934.tmp"73⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\49A2.tmp"C:\Users\Admin\AppData\Local\Temp\49A2.tmp"74⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\4A1F.tmp"C:\Users\Admin\AppData\Local\Temp\4A1F.tmp"75⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\4ABB.tmp"C:\Users\Admin\AppData\Local\Temp\4ABB.tmp"76⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\4B67.tmp"C:\Users\Admin\AppData\Local\Temp\4B67.tmp"77⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\4BF3.tmp"C:\Users\Admin\AppData\Local\Temp\4BF3.tmp"78⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\4C70.tmp"C:\Users\Admin\AppData\Local\Temp\4C70.tmp"79⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"80⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\4D8A.tmp"C:\Users\Admin\AppData\Local\Temp\4D8A.tmp"81⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\4E16.tmp"C:\Users\Admin\AppData\Local\Temp\4E16.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\4E93.tmp"C:\Users\Admin\AppData\Local\Temp\4E93.tmp"83⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"C:\Users\Admin\AppData\Local\Temp\4EF1.tmp"84⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\4F6E.tmp"C:\Users\Admin\AppData\Local\Temp\4F6E.tmp"85⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\4FFB.tmp"C:\Users\Admin\AppData\Local\Temp\4FFB.tmp"86⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\50A7.tmp"C:\Users\Admin\AppData\Local\Temp\50A7.tmp"87⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\5143.tmp"C:\Users\Admin\AppData\Local\Temp\5143.tmp"88⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\51DF.tmp"C:\Users\Admin\AppData\Local\Temp\51DF.tmp"89⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\526C.tmp"C:\Users\Admin\AppData\Local\Temp\526C.tmp"90⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\52E9.tmp"C:\Users\Admin\AppData\Local\Temp\52E9.tmp"91⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\53A4.tmp"C:\Users\Admin\AppData\Local\Temp\53A4.tmp"92⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\5431.tmp"C:\Users\Admin\AppData\Local\Temp\5431.tmp"93⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\54AE.tmp"C:\Users\Admin\AppData\Local\Temp\54AE.tmp"94⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\552B.tmp"C:\Users\Admin\AppData\Local\Temp\552B.tmp"95⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\55A8.tmp"C:\Users\Admin\AppData\Local\Temp\55A8.tmp"96⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\5625.tmp"C:\Users\Admin\AppData\Local\Temp\5625.tmp"97⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\56A2.tmp"C:\Users\Admin\AppData\Local\Temp\56A2.tmp"98⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\571F.tmp"C:\Users\Admin\AppData\Local\Temp\571F.tmp"99⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\57BB.tmp"C:\Users\Admin\AppData\Local\Temp\57BB.tmp"100⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\5848.tmp"C:\Users\Admin\AppData\Local\Temp\5848.tmp"101⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\58E4.tmp"C:\Users\Admin\AppData\Local\Temp\58E4.tmp"102⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\5951.tmp"C:\Users\Admin\AppData\Local\Temp\5951.tmp"103⤵PID:5740
-
C:\Users\Admin\AppData\Local\Temp\59DE.tmp"C:\Users\Admin\AppData\Local\Temp\59DE.tmp"104⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\5A5B.tmp"C:\Users\Admin\AppData\Local\Temp\5A5B.tmp"105⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\5AE8.tmp"C:\Users\Admin\AppData\Local\Temp\5AE8.tmp"106⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\5B84.tmp"C:\Users\Admin\AppData\Local\Temp\5B84.tmp"107⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\5C10.tmp"C:\Users\Admin\AppData\Local\Temp\5C10.tmp"108⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\5C8D.tmp"C:\Users\Admin\AppData\Local\Temp\5C8D.tmp"109⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\5D0A.tmp"C:\Users\Admin\AppData\Local\Temp\5D0A.tmp"110⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\5D87.tmp"C:\Users\Admin\AppData\Local\Temp\5D87.tmp"111⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\5E04.tmp"C:\Users\Admin\AppData\Local\Temp\5E04.tmp"112⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\5E81.tmp"C:\Users\Admin\AppData\Local\Temp\5E81.tmp"113⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\5EEF.tmp"C:\Users\Admin\AppData\Local\Temp\5EEF.tmp"114⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"115⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\6008.tmp"C:\Users\Admin\AppData\Local\Temp\6008.tmp"116⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\60B4.tmp"C:\Users\Admin\AppData\Local\Temp\60B4.tmp"117⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\6141.tmp"C:\Users\Admin\AppData\Local\Temp\6141.tmp"118⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\61EC.tmp"C:\Users\Admin\AppData\Local\Temp\61EC.tmp"119⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\6298.tmp"C:\Users\Admin\AppData\Local\Temp\6298.tmp"120⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\6344.tmp"C:\Users\Admin\AppData\Local\Temp\6344.tmp"121⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\63F0.tmp"C:\Users\Admin\AppData\Local\Temp\63F0.tmp"122⤵PID:2084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-