Analysis
- max time kernel
119s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 13:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_96b4e69f5b0ab814e46656c1540af408_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_96b4e69f5b0ab814e46656c1540af408_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-12_96b4e69f5b0ab814e46656c1540af408_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260812-p8metsxemb
- SHA256 7b3082847416e7852c50b2aa4cfd97104addc118e13fcfcf7b4ea64e558deb52
- MD5 96b4e69f5b0ab814e46656c1540af408
- SHA1 679c310122091a3a812d28b0b1d51253b5065ba7
- SHA512 e030cabad83bb7fe7ad22a16a9267eade4cbd4ab159df20ce2e998198e7ff6242104ec006624dc4b38ba0efb9d163770a55667629130c5b2259b7815fc535a7b
- SSDEEP 12288:NU5rCOTeijBX6kqxGqZeDqYhmCNg21wz/uTZwlH:NUQOJjckoGl7NXazuTSlH
- TLSH T110B4F116B589C033E6D302310AE6EBB26A3BBC35572664C32784A67D2FB17D1E375306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3472 110D.tmp 4216 11F8.tmp 4792 1524.tmp 3324 15E0.tmp 4076 16CA.tmp 860 17A5.tmp 4328 1860.tmp 2492 191C.tmp 3352 19D7.tmp 3840 1A93.tmp 1964 1B3F.tmp 5956 1BCB.tmp 2660 1C96.tmp 996 1D71.tmp 692 1E0D.tmp 5196 1EF8.tmp 4264 1F84.tmp 5708 2011.tmp 1088 208E.tmp 364 2188.tmp 240 2234.tmp 1100 22EF.tmp 4484 23CA.tmp 5168 2476.tmp 752 2541.tmp 4644 25FD.tmp 5108 26C8.tmp 2352 2754.tmp 1408 283F.tmp 3784 28EB.tmp 5588 29B6.tmp 1880 2A81.tmp 3292 2B3C.tmp 2172 2BE8.tmp 5248 2C65.tmp 5048 2D11.tmp 5728 2D8E.tmp 5372 2E1B.tmp 2852 2EA7.tmp 5680 2F34.tmp 5044 2FC1.tmp 1836 303E.tmp 1764 30BB.tmp 5164 3147.tmp 5756 31D4.tmp 3536 3270.tmp 1456 331C.tmp 908 3399.tmp 3404 3455.tmp 4304 34F1.tmp 624 357D.tmp 1944 361A.tmp 4396 36B6.tmp 5076 3743.tmp 2892 37CF.tmp 5512 387B.tmp 4784 38E8.tmp 3140 3975.tmp 3184 39E2.tmp 4288 3A6F.tmp 5340 3AEC.tmp 1936 3B79.tmp 5160 3C05.tmp 5904 3C92.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1956.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ED2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F831.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3356.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 476A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 191C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 387B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B23F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2471.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8965.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D553.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2730.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B22B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7020.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C092.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_96b4e69f5b0ab814e46656c1540af408_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 842A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8860.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F217.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4017.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9531.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9958.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7149.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C43C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2934.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68B3.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4712 wrote to memory of 3472 4712 2026-08-12_96b4e69f5b0ab814e46656c1540af408_elex_mafia_stealc_tofsee.exe 89 PID 3472 wrote to memory of 4216 3472 110D.tmp 90 PID 4216 wrote to memory of 4792 4216 11F8.tmp 91 PID 4792 wrote to memory of 3324 4792 1524.tmp 92 PID 3324 wrote to memory of 4076 3324 15E0.tmp 93 PID 4076 wrote to memory of 860 4076 16CA.tmp 94 PID 860 wrote to memory of 4328 860 17A5.tmp 95 PID 4328 wrote to memory of 2492 4328 1860.tmp 96 PID 2492 wrote to memory of 3352 2492 191C.tmp 97 PID 3352 wrote to memory of 3840 3352 19D7.tmp 98 PID 3840 wrote to memory of 1964 3840 1A93.tmp 99 PID 1964 wrote to memory of 5956 1964 1B3F.tmp 100 PID 5956 wrote to memory of 2660 5956 1BCB.tmp 101 PID 2660 wrote to memory of 996 2660 1C96.tmp 102 PID 996 wrote to memory of 692 996 1D71.tmp 103 PID 692 wrote to memory of 5196 692 1E0D.tmp 104 PID 5196 wrote to memory of 4264 5196 1EF8.tmp 105 PID 4264 wrote to memory of 5708 4264 1F84.tmp 106 PID 5708 wrote to memory of 1088 5708 2011.tmp 107 PID 1088 wrote to memory of 364 1088 208E.tmp 108 PID 364 wrote to memory of 240 364 2188.tmp 109 PID 240 wrote to memory of 1100 240 2234.tmp 110 PID 1100 wrote to memory of 4484 1100 22EF.tmp 111 PID 4484 wrote to memory of 5168 4484 23CA.tmp 112 PID 5168 wrote to memory of 752 5168 2476.tmp 113 PID 752 wrote to memory of 4644 752 2541.tmp 114 PID 4644 wrote to memory of 5108 4644 25FD.tmp 115 PID 5108 wrote to memory of 2352 5108 26C8.tmp 116 PID 2352 wrote to memory of 1408 2352 2754.tmp 117 PID 1408 wrote to memory of 3784 1408 283F.tmp 118 PID 3784 wrote to memory of 5588 3784 28EB.tmp 119 PID 5588 wrote to memory of 1880 5588 29B6.tmp 120 PID 1880 wrote to memory of 3292 1880 2A81.tmp 121 PID 3292 wrote to memory of 2172 3292 2B3C.tmp 122 PID 2172 wrote to memory of 5248 2172 2BE8.tmp 123 PID 5248 wrote to memory of 5048 5248 2C65.tmp 124 PID 5048 wrote to memory of 5728 5048 2D11.tmp 125 PID 5728 wrote to memory of 5372 5728 2D8E.tmp 126 PID 5372 wrote to memory of 2852 5372 2E1B.tmp 127 PID 2852 wrote to memory of 5680 2852 2EA7.tmp 128 PID 5680 wrote to memory of 5044 5680 2F34.tmp 129 PID 5044 wrote to memory of 1836 5044 2FC1.tmp 130 PID 1836 wrote to memory of 1764 1836 303E.tmp 131 PID 1764 wrote to memory of 5164 1764 30BB.tmp 132 PID 5164 wrote to memory of 5756 5164 3147.tmp 133 PID 5756 wrote to memory of 3536 5756 31D4.tmp 134 PID 3536 wrote to memory of 1456 3536 3270.tmp 135 PID 1456 wrote to memory of 908 1456 331C.tmp 136 PID 908 wrote to memory of 3404 908 3399.tmp 137 PID 3404 wrote to memory of 4304 3404 3455.tmp 138 PID 4304 wrote to memory of 624 4304 34F1.tmp 139 PID 624 wrote to memory of 1944 624 357D.tmp 140 PID 1944 wrote to memory of 4396 1944 361A.tmp 141 PID 4396 wrote to memory of 5076 4396 36B6.tmp 142 PID 5076 wrote to memory of 2892 5076 3743.tmp 143 PID 2892 wrote to memory of 5512 2892 37CF.tmp 144 PID 5512 wrote to memory of 4784 5512 387B.tmp 145 PID 4784 wrote to memory of 3140 4784 38E8.tmp 146 PID 3140 wrote to memory of 3184 3140 3975.tmp 147 PID 3184 wrote to memory of 4288 3184 39E2.tmp 148 PID 4288 wrote to memory of 5340 4288 3A6F.tmp 149 PID 5340 wrote to memory of 1936 5340 3AEC.tmp 150 PID 1936 wrote to memory of 5160 1936 3B79.tmp 151 PID 5160 wrote to memory of 5904 5160 3C05.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_96b4e69f5b0ab814e46656c1540af408_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_96b4e69f5b0ab814e46656c1540af408_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\110D.tmp"C:\Users\Admin\AppData\Local\Temp\110D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\11F8.tmp"C:\Users\Admin\AppData\Local\Temp\11F8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\1524.tmp"C:\Users\Admin\AppData\Local\Temp\1524.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\15E0.tmp"C:\Users\Admin\AppData\Local\Temp\15E0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\16CA.tmp"C:\Users\Admin\AppData\Local\Temp\16CA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\17A5.tmp"C:\Users\Admin\AppData\Local\Temp\17A5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\1860.tmp"C:\Users\Admin\AppData\Local\Temp\1860.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\1A93.tmp"C:\Users\Admin\AppData\Local\Temp\1A93.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"C:\Users\Admin\AppData\Local\Temp\1B3F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\1BCB.tmp"C:\Users\Admin\AppData\Local\Temp\1BCB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\1C96.tmp"C:\Users\Admin\AppData\Local\Temp\1C96.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\1D71.tmp"C:\Users\Admin\AppData\Local\Temp\1D71.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\1E0D.tmp"C:\Users\Admin\AppData\Local\Temp\1E0D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\1EF8.tmp"C:\Users\Admin\AppData\Local\Temp\1EF8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\1F84.tmp"C:\Users\Admin\AppData\Local\Temp\1F84.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\2011.tmp"C:\Users\Admin\AppData\Local\Temp\2011.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\208E.tmp"C:\Users\Admin\AppData\Local\Temp\208E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\2188.tmp"C:\Users\Admin\AppData\Local\Temp\2188.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\2234.tmp"C:\Users\Admin\AppData\Local\Temp\2234.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\Temp\22EF.tmp"C:\Users\Admin\AppData\Local\Temp\22EF.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\23CA.tmp"C:\Users\Admin\AppData\Local\Temp\23CA.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\2476.tmp"C:\Users\Admin\AppData\Local\Temp\2476.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\2541.tmp"C:\Users\Admin\AppData\Local\Temp\2541.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\25FD.tmp"C:\Users\Admin\AppData\Local\Temp\25FD.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\26C8.tmp"C:\Users\Admin\AppData\Local\Temp\26C8.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\2754.tmp"C:\Users\Admin\AppData\Local\Temp\2754.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\283F.tmp"C:\Users\Admin\AppData\Local\Temp\283F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\28EB.tmp"C:\Users\Admin\AppData\Local\Temp\28EB.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\29B6.tmp"C:\Users\Admin\AppData\Local\Temp\29B6.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\2A81.tmp"C:\Users\Admin\AppData\Local\Temp\2A81.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\2B3C.tmp"C:\Users\Admin\AppData\Local\Temp\2B3C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\2BE8.tmp"C:\Users\Admin\AppData\Local\Temp\2BE8.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\2C65.tmp"C:\Users\Admin\AppData\Local\Temp\2C65.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5248 -
C:\Users\Admin\AppData\Local\Temp\2D11.tmp"C:\Users\Admin\AppData\Local\Temp\2D11.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\2D8E.tmp"C:\Users\Admin\AppData\Local\Temp\2D8E.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"C:\Users\Admin\AppData\Local\Temp\2E1B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\2EA7.tmp"C:\Users\Admin\AppData\Local\Temp\2EA7.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\2F34.tmp"C:\Users\Admin\AppData\Local\Temp\2F34.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\2FC1.tmp"C:\Users\Admin\AppData\Local\Temp\2FC1.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\303E.tmp"C:\Users\Admin\AppData\Local\Temp\303E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\30BB.tmp"C:\Users\Admin\AppData\Local\Temp\30BB.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\3147.tmp"C:\Users\Admin\AppData\Local\Temp\3147.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\31D4.tmp"C:\Users\Admin\AppData\Local\Temp\31D4.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\3270.tmp"C:\Users\Admin\AppData\Local\Temp\3270.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\331C.tmp"C:\Users\Admin\AppData\Local\Temp\331C.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\3399.tmp"C:\Users\Admin\AppData\Local\Temp\3399.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\3455.tmp"C:\Users\Admin\AppData\Local\Temp\3455.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\34F1.tmp"C:\Users\Admin\AppData\Local\Temp\34F1.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\357D.tmp"C:\Users\Admin\AppData\Local\Temp\357D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\361A.tmp"C:\Users\Admin\AppData\Local\Temp\361A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\36B6.tmp"C:\Users\Admin\AppData\Local\Temp\36B6.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\3743.tmp"C:\Users\Admin\AppData\Local\Temp\3743.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\37CF.tmp"C:\Users\Admin\AppData\Local\Temp\37CF.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\387B.tmp"C:\Users\Admin\AppData\Local\Temp\387B.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\38E8.tmp"C:\Users\Admin\AppData\Local\Temp\38E8.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\3975.tmp"C:\Users\Admin\AppData\Local\Temp\3975.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\39E2.tmp"C:\Users\Admin\AppData\Local\Temp\39E2.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\3AEC.tmp"C:\Users\Admin\AppData\Local\Temp\3AEC.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\3B79.tmp"C:\Users\Admin\AppData\Local\Temp\3B79.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\3C05.tmp"C:\Users\Admin\AppData\Local\Temp\3C05.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\3C92.tmp"C:\Users\Admin\AppData\Local\Temp\3C92.tmp"65⤵
- Executes dropped EXE
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\3D1F.tmp"C:\Users\Admin\AppData\Local\Temp\3D1F.tmp"66⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"67⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\3E09.tmp"C:\Users\Admin\AppData\Local\Temp\3E09.tmp"68⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\3EA5.tmp"C:\Users\Admin\AppData\Local\Temp\3EA5.tmp"69⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\3F22.tmp"C:\Users\Admin\AppData\Local\Temp\3F22.tmp"70⤵PID:5620
-
C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"C:\Users\Admin\AppData\Local\Temp\3FBE.tmp"71⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\405B.tmp"C:\Users\Admin\AppData\Local\Temp\405B.tmp"72⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\40F7.tmp"C:\Users\Admin\AppData\Local\Temp\40F7.tmp"73⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\4193.tmp"C:\Users\Admin\AppData\Local\Temp\4193.tmp"74⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\422F.tmp"C:\Users\Admin\AppData\Local\Temp\422F.tmp"75⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\42AC.tmp"C:\Users\Admin\AppData\Local\Temp\42AC.tmp"76⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\4329.tmp"C:\Users\Admin\AppData\Local\Temp\4329.tmp"77⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\43C6.tmp"C:\Users\Admin\AppData\Local\Temp\43C6.tmp"78⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\4472.tmp"C:\Users\Admin\AppData\Local\Temp\4472.tmp"79⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\44FE.tmp"C:\Users\Admin\AppData\Local\Temp\44FE.tmp"80⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\458B.tmp"C:\Users\Admin\AppData\Local\Temp\458B.tmp"81⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\4617.tmp"C:\Users\Admin\AppData\Local\Temp\4617.tmp"82⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\4694.tmp"C:\Users\Admin\AppData\Local\Temp\4694.tmp"83⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\4711.tmp"C:\Users\Admin\AppData\Local\Temp\4711.tmp"84⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\479E.tmp"C:\Users\Admin\AppData\Local\Temp\479E.tmp"85⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\481B.tmp"C:\Users\Admin\AppData\Local\Temp\481B.tmp"86⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\48D7.tmp"C:\Users\Admin\AppData\Local\Temp\48D7.tmp"87⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\4963.tmp"C:\Users\Admin\AppData\Local\Temp\4963.tmp"88⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\49E0.tmp"C:\Users\Admin\AppData\Local\Temp\49E0.tmp"89⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"90⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\4AF9.tmp"C:\Users\Admin\AppData\Local\Temp\4AF9.tmp"91⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\4B67.tmp"C:\Users\Admin\AppData\Local\Temp\4B67.tmp"92⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"C:\Users\Admin\AppData\Local\Temp\4BD4.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\4C51.tmp"C:\Users\Admin\AppData\Local\Temp\4C51.tmp"94⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"95⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\4D8A.tmp"C:\Users\Admin\AppData\Local\Temp\4D8A.tmp"96⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\4E26.tmp"C:\Users\Admin\AppData\Local\Temp\4E26.tmp"97⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\4ED2.tmp"C:\Users\Admin\AppData\Local\Temp\4ED2.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"C:\Users\Admin\AppData\Local\Temp\4F7E.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\4FEB.tmp"C:\Users\Admin\AppData\Local\Temp\4FEB.tmp"100⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\5078.tmp"C:\Users\Admin\AppData\Local\Temp\5078.tmp"101⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\50F5.tmp"C:\Users\Admin\AppData\Local\Temp\50F5.tmp"102⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\5191.tmp"C:\Users\Admin\AppData\Local\Temp\5191.tmp"103⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\523D.tmp"C:\Users\Admin\AppData\Local\Temp\523D.tmp"104⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\52C9.tmp"C:\Users\Admin\AppData\Local\Temp\52C9.tmp"105⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\5356.tmp"C:\Users\Admin\AppData\Local\Temp\5356.tmp"106⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\53D3.tmp"C:\Users\Admin\AppData\Local\Temp\53D3.tmp"107⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\5440.tmp"C:\Users\Admin\AppData\Local\Temp\5440.tmp"108⤵PID:5464
-
C:\Users\Admin\AppData\Local\Temp\54DD.tmp"C:\Users\Admin\AppData\Local\Temp\54DD.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\5579.tmp"C:\Users\Admin\AppData\Local\Temp\5579.tmp"110⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\5606.tmp"C:\Users\Admin\AppData\Local\Temp\5606.tmp"111⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\5692.tmp"C:\Users\Admin\AppData\Local\Temp\5692.tmp"112⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\571F.tmp"C:\Users\Admin\AppData\Local\Temp\571F.tmp"113⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\57CB.tmp"C:\Users\Admin\AppData\Local\Temp\57CB.tmp"114⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\5867.tmp"C:\Users\Admin\AppData\Local\Temp\5867.tmp"115⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\5903.tmp"C:\Users\Admin\AppData\Local\Temp\5903.tmp"116⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\5980.tmp"C:\Users\Admin\AppData\Local\Temp\5980.tmp"117⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\59FD.tmp"C:\Users\Admin\AppData\Local\Temp\59FD.tmp"118⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\5AE8.tmp"C:\Users\Admin\AppData\Local\Temp\5AE8.tmp"120⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\5B74.tmp"C:\Users\Admin\AppData\Local\Temp\5B74.tmp"121⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\5BF1.tmp"C:\Users\Admin\AppData\Local\Temp\5BF1.tmp"122⤵PID:424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-