Analysis
- max time kernel
129s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 01:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_f058f7d240623bded049df5e10578b1b_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_f058f7d240623bded049df5e10578b1b_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-14_f058f7d240623bded049df5e10578b1b_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260814-brcbms11at
- SHA256 936b9dfc0a894a029a747a1abbdef72484505ff6e56cd07d909945ac373016ba
- MD5 f058f7d240623bded049df5e10578b1b
- SHA1 11056ae1f4107c355c1846082b27ed88cd7e29e7
- SHA512 cebbd924060a3b8701b053b053fa010dcb06ff78f0efed908c7c6fc5e201b406e34f6152c083fbd4b2554d8dc7966079c1f7821452d01b0f687f4c453a7e36d3
- SSDEEP 12288:wU5rCOTeiDoDomGLjDWih6UlvVM0NZ+3/v+I9hUG2VA:wUQOJDYom+jD7Qia0NGEA
- TLSH T134E4D12173D88532E5FB037859B5E6654D7EBD326722D6CF2F8012AE0AB1BC09671723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5532 36C6.tmp 2196 37CF.tmp 5816 3965.tmp 2076 3A9E.tmp 2452 3B1B.tmp 3732 3D3E.tmp 2528 3DCA.tmp 5756 3F03.tmp 4432 3FED.tmp 4632 40E7.tmp 4660 423F.tmp 2804 4329.tmp 124 4443.tmp 6020 457B.tmp 2008 4646.tmp 5880 4740.tmp 6028 4879.tmp 3576 4973.tmp 4800 4A6D.tmp 2704 4B57.tmp 4596 4CAF.tmp 2168 4DB9.tmp 4676 4F30.tmp 5852 5058.tmp 2024 5162.tmp 2852 525C.tmp 5228 5346.tmp 772 546F.tmp 4584 5579.tmp 2412 5673.tmp 4480 579C.tmp 2584 58F4.tmp 3664 5A1C.tmp 1896 5AF7.tmp 4160 5B93.tmp 4092 5C30.tmp 2512 5D1A.tmp 2252 5E24.tmp 4600 5EA1.tmp 4904 5F3D.tmp 4176 5FF8.tmp 5876 6095.tmp 1848 617F.tmp 2428 622B.tmp 1980 62C7.tmp 1340 6383.tmp 5996 640F.tmp 4460 64FA.tmp 5668 65A6.tmp 3356 6623.tmp 1588 66AF.tmp 5496 674B.tmp 2648 67D8.tmp 672 6874.tmp 4888 6920.tmp 1272 69BC.tmp 4256 6A49.tmp 2456 6AD6.tmp 5596 6B72.tmp 5324 6C0E.tmp 5956 6C9B.tmp 784 6D37.tmp 3184 6DC4.tmp 4780 6E50.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1838.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A49E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BECD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F87B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D93F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D533.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A980.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 219E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9021.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 206A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8212.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B19E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D022.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E57F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6095.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6383.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A927.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 135A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B528.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CECF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8081.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B53D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7011.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F222.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC9F.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5168 wrote to memory of 5532 5168 2026-08-14_f058f7d240623bded049df5e10578b1b_elex_mafia_stealc_tofsee.exe 89 PID 5532 wrote to memory of 2196 5532 36C6.tmp 90 PID 2196 wrote to memory of 5816 2196 37CF.tmp 91 PID 5816 wrote to memory of 2076 5816 3965.tmp 92 PID 2076 wrote to memory of 2452 2076 3A9E.tmp 93 PID 2452 wrote to memory of 3732 2452 3B1B.tmp 94 PID 3732 wrote to memory of 2528 3732 3D3E.tmp 95 PID 2528 wrote to memory of 5756 2528 3DCA.tmp 96 PID 5756 wrote to memory of 4432 5756 3F03.tmp 97 PID 4432 wrote to memory of 4632 4432 3FED.tmp 98 PID 4632 wrote to memory of 4660 4632 40E7.tmp 99 PID 4660 wrote to memory of 2804 4660 423F.tmp 100 PID 2804 wrote to memory of 124 2804 4329.tmp 101 PID 124 wrote to memory of 6020 124 4443.tmp 102 PID 6020 wrote to memory of 2008 6020 457B.tmp 103 PID 2008 wrote to memory of 5880 2008 4646.tmp 104 PID 5880 wrote to memory of 6028 5880 4740.tmp 105 PID 6028 wrote to memory of 3576 6028 4879.tmp 106 PID 3576 wrote to memory of 4800 3576 4973.tmp 107 PID 4800 wrote to memory of 2704 4800 4A6D.tmp 108 PID 2704 wrote to memory of 4596 2704 4B57.tmp 109 PID 4596 wrote to memory of 2168 4596 4CAF.tmp 110 PID 2168 wrote to memory of 4676 2168 4DB9.tmp 111 PID 4676 wrote to memory of 5852 4676 4F30.tmp 112 PID 5852 wrote to memory of 2024 5852 5058.tmp 113 PID 2024 wrote to memory of 2852 2024 5162.tmp 114 PID 2852 wrote to memory of 5228 2852 525C.tmp 115 PID 5228 wrote to memory of 772 5228 5346.tmp 116 PID 772 wrote to memory of 4584 772 546F.tmp 117 PID 4584 wrote to memory of 2412 4584 5579.tmp 118 PID 2412 wrote to memory of 4480 2412 5673.tmp 119 PID 4480 wrote to memory of 2584 4480 579C.tmp 120 PID 2584 wrote to memory of 3664 2584 58F4.tmp 121 PID 3664 wrote to memory of 1896 3664 5A1C.tmp 122 PID 1896 wrote to memory of 4160 1896 5AF7.tmp 123 PID 4160 wrote to memory of 4092 4160 5B93.tmp 124 PID 4092 wrote to memory of 2512 4092 5C30.tmp 125 PID 2512 wrote to memory of 2252 2512 5D1A.tmp 126 PID 2252 wrote to memory of 4600 2252 5E24.tmp 127 PID 4600 wrote to memory of 4904 4600 5EA1.tmp 128 PID 4904 wrote to memory of 4176 4904 5F3D.tmp 129 PID 4176 wrote to memory of 5876 4176 5FF8.tmp 130 PID 5876 wrote to memory of 1848 5876 6095.tmp 131 PID 1848 wrote to memory of 2428 1848 617F.tmp 132 PID 2428 wrote to memory of 1980 2428 622B.tmp 133 PID 1980 wrote to memory of 1340 1980 62C7.tmp 134 PID 1340 wrote to memory of 5996 1340 6383.tmp 135 PID 5996 wrote to memory of 4460 5996 640F.tmp 136 PID 4460 wrote to memory of 5668 4460 64FA.tmp 137 PID 5668 wrote to memory of 3356 5668 65A6.tmp 138 PID 3356 wrote to memory of 1588 3356 6623.tmp 139 PID 1588 wrote to memory of 5496 1588 66AF.tmp 140 PID 5496 wrote to memory of 2648 5496 674B.tmp 141 PID 2648 wrote to memory of 672 2648 67D8.tmp 142 PID 672 wrote to memory of 4888 672 6874.tmp 143 PID 4888 wrote to memory of 1272 4888 6920.tmp 144 PID 1272 wrote to memory of 4256 1272 69BC.tmp 145 PID 4256 wrote to memory of 2456 4256 6A49.tmp 146 PID 2456 wrote to memory of 5596 2456 6AD6.tmp 147 PID 5596 wrote to memory of 5324 5596 6B72.tmp 148 PID 5324 wrote to memory of 5956 5324 6C0E.tmp 149 PID 5956 wrote to memory of 784 5956 6C9B.tmp 150 PID 784 wrote to memory of 3184 784 6D37.tmp 151 PID 3184 wrote to memory of 4780 3184 6DC4.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_f058f7d240623bded049df5e10578b1b_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_f058f7d240623bded049df5e10578b1b_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\36C6.tmp"C:\Users\Admin\AppData\Local\Temp\36C6.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\37CF.tmp"C:\Users\Admin\AppData\Local\Temp\37CF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\3965.tmp"C:\Users\Admin\AppData\Local\Temp\3965.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"C:\Users\Admin\AppData\Local\Temp\3A9E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"C:\Users\Admin\AppData\Local\Temp\3B1B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\3D3E.tmp"C:\Users\Admin\AppData\Local\Temp\3D3E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\3DCA.tmp"C:\Users\Admin\AppData\Local\Temp\3DCA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\3F03.tmp"C:\Users\Admin\AppData\Local\Temp\3F03.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\423F.tmp"C:\Users\Admin\AppData\Local\Temp\423F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\4329.tmp"C:\Users\Admin\AppData\Local\Temp\4329.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\4443.tmp"C:\Users\Admin\AppData\Local\Temp\4443.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\457B.tmp"C:\Users\Admin\AppData\Local\Temp\457B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\4646.tmp"C:\Users\Admin\AppData\Local\Temp\4646.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\4740.tmp"C:\Users\Admin\AppData\Local\Temp\4740.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\4879.tmp"C:\Users\Admin\AppData\Local\Temp\4879.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\4973.tmp"C:\Users\Admin\AppData\Local\Temp\4973.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\4B57.tmp"C:\Users\Admin\AppData\Local\Temp\4B57.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\4DB9.tmp"C:\Users\Admin\AppData\Local\Temp\4DB9.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\4F30.tmp"C:\Users\Admin\AppData\Local\Temp\4F30.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\5058.tmp"C:\Users\Admin\AppData\Local\Temp\5058.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\5162.tmp"C:\Users\Admin\AppData\Local\Temp\5162.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\525C.tmp"C:\Users\Admin\AppData\Local\Temp\525C.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\5346.tmp"C:\Users\Admin\AppData\Local\Temp\5346.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5228 -
C:\Users\Admin\AppData\Local\Temp\546F.tmp"C:\Users\Admin\AppData\Local\Temp\546F.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\5579.tmp"C:\Users\Admin\AppData\Local\Temp\5579.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\5673.tmp"C:\Users\Admin\AppData\Local\Temp\5673.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\579C.tmp"C:\Users\Admin\AppData\Local\Temp\579C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\58F4.tmp"C:\Users\Admin\AppData\Local\Temp\58F4.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\5A1C.tmp"C:\Users\Admin\AppData\Local\Temp\5A1C.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\5AF7.tmp"C:\Users\Admin\AppData\Local\Temp\5AF7.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\5B93.tmp"C:\Users\Admin\AppData\Local\Temp\5B93.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\5C30.tmp"C:\Users\Admin\AppData\Local\Temp\5C30.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\5D1A.tmp"C:\Users\Admin\AppData\Local\Temp\5D1A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\5E24.tmp"C:\Users\Admin\AppData\Local\Temp\5E24.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\5EA1.tmp"C:\Users\Admin\AppData\Local\Temp\5EA1.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\5FF8.tmp"C:\Users\Admin\AppData\Local\Temp\5FF8.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\6095.tmp"C:\Users\Admin\AppData\Local\Temp\6095.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\617F.tmp"C:\Users\Admin\AppData\Local\Temp\617F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\622B.tmp"C:\Users\Admin\AppData\Local\Temp\622B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\62C7.tmp"C:\Users\Admin\AppData\Local\Temp\62C7.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\6383.tmp"C:\Users\Admin\AppData\Local\Temp\6383.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\640F.tmp"C:\Users\Admin\AppData\Local\Temp\640F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\64FA.tmp"C:\Users\Admin\AppData\Local\Temp\64FA.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\65A6.tmp"C:\Users\Admin\AppData\Local\Temp\65A6.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\6623.tmp"C:\Users\Admin\AppData\Local\Temp\6623.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\66AF.tmp"C:\Users\Admin\AppData\Local\Temp\66AF.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\674B.tmp"C:\Users\Admin\AppData\Local\Temp\674B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\67D8.tmp"C:\Users\Admin\AppData\Local\Temp\67D8.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\6874.tmp"C:\Users\Admin\AppData\Local\Temp\6874.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\6920.tmp"C:\Users\Admin\AppData\Local\Temp\6920.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\69BC.tmp"C:\Users\Admin\AppData\Local\Temp\69BC.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\6A49.tmp"C:\Users\Admin\AppData\Local\Temp\6A49.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\6AD6.tmp"C:\Users\Admin\AppData\Local\Temp\6AD6.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\6B72.tmp"C:\Users\Admin\AppData\Local\Temp\6B72.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\6C9B.tmp"C:\Users\Admin\AppData\Local\Temp\6C9B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\6D37.tmp"C:\Users\Admin\AppData\Local\Temp\6D37.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\6DC4.tmp"C:\Users\Admin\AppData\Local\Temp\6DC4.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\6E50.tmp"C:\Users\Admin\AppData\Local\Temp\6E50.tmp"65⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\6EDD.tmp"C:\Users\Admin\AppData\Local\Temp\6EDD.tmp"66⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\6F89.tmp"C:\Users\Admin\AppData\Local\Temp\6F89.tmp"67⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\7025.tmp"C:\Users\Admin\AppData\Local\Temp\7025.tmp"68⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\70C1.tmp"C:\Users\Admin\AppData\Local\Temp\70C1.tmp"69⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\713E.tmp"C:\Users\Admin\AppData\Local\Temp\713E.tmp"70⤵PID:204
-
C:\Users\Admin\AppData\Local\Temp\71DB.tmp"C:\Users\Admin\AppData\Local\Temp\71DB.tmp"71⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\7258.tmp"C:\Users\Admin\AppData\Local\Temp\7258.tmp"72⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\72F4.tmp"C:\Users\Admin\AppData\Local\Temp\72F4.tmp"73⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\7371.tmp"C:\Users\Admin\AppData\Local\Temp\7371.tmp"74⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\740D.tmp"C:\Users\Admin\AppData\Local\Temp\740D.tmp"75⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\747A.tmp"C:\Users\Admin\AppData\Local\Temp\747A.tmp"76⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\74F7.tmp"C:\Users\Admin\AppData\Local\Temp\74F7.tmp"77⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\7574.tmp"C:\Users\Admin\AppData\Local\Temp\7574.tmp"78⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\7601.tmp"C:\Users\Admin\AppData\Local\Temp\7601.tmp"79⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\768E.tmp"C:\Users\Admin\AppData\Local\Temp\768E.tmp"80⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\76FB.tmp"C:\Users\Admin\AppData\Local\Temp\76FB.tmp"81⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\7768.tmp"C:\Users\Admin\AppData\Local\Temp\7768.tmp"82⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\77F5.tmp"C:\Users\Admin\AppData\Local\Temp\77F5.tmp"83⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\7882.tmp"C:\Users\Admin\AppData\Local\Temp\7882.tmp"84⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\78EF.tmp"C:\Users\Admin\AppData\Local\Temp\78EF.tmp"85⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\796C.tmp"C:\Users\Admin\AppData\Local\Temp\796C.tmp"86⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\7A08.tmp"C:\Users\Admin\AppData\Local\Temp\7A08.tmp"87⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\7A76.tmp"C:\Users\Admin\AppData\Local\Temp\7A76.tmp"88⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\7B02.tmp"C:\Users\Admin\AppData\Local\Temp\7B02.tmp"89⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"90⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"91⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\7C89.tmp"C:\Users\Admin\AppData\Local\Temp\7C89.tmp"92⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\7D06.tmp"C:\Users\Admin\AppData\Local\Temp\7D06.tmp"93⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\7D93.tmp"C:\Users\Admin\AppData\Local\Temp\7D93.tmp"94⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\7E10.tmp"C:\Users\Admin\AppData\Local\Temp\7E10.tmp"95⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"C:\Users\Admin\AppData\Local\Temp\7E8D.tmp"96⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"C:\Users\Admin\AppData\Local\Temp\7F0A.tmp"97⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\7F77.tmp"C:\Users\Admin\AppData\Local\Temp\7F77.tmp"98⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"C:\Users\Admin\AppData\Local\Temp\7FF4.tmp"99⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\8081.tmp"C:\Users\Admin\AppData\Local\Temp\8081.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\812C.tmp"C:\Users\Admin\AppData\Local\Temp\812C.tmp"101⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\81A9.tmp"C:\Users\Admin\AppData\Local\Temp\81A9.tmp"102⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\8246.tmp"C:\Users\Admin\AppData\Local\Temp\8246.tmp"103⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\82E2.tmp"C:\Users\Admin\AppData\Local\Temp\82E2.tmp"104⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\837E.tmp"C:\Users\Admin\AppData\Local\Temp\837E.tmp"105⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\840B.tmp"C:\Users\Admin\AppData\Local\Temp\840B.tmp"106⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\84A7.tmp"C:\Users\Admin\AppData\Local\Temp\84A7.tmp"107⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\8543.tmp"C:\Users\Admin\AppData\Local\Temp\8543.tmp"108⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\85FF.tmp"C:\Users\Admin\AppData\Local\Temp\85FF.tmp"109⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\867C.tmp"C:\Users\Admin\AppData\Local\Temp\867C.tmp"110⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\8718.tmp"C:\Users\Admin\AppData\Local\Temp\8718.tmp"111⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\8795.tmp"C:\Users\Admin\AppData\Local\Temp\8795.tmp"112⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\8841.tmp"C:\Users\Admin\AppData\Local\Temp\8841.tmp"113⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\88CE.tmp"C:\Users\Admin\AppData\Local\Temp\88CE.tmp"114⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\894B.tmp"C:\Users\Admin\AppData\Local\Temp\894B.tmp"115⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\89D7.tmp"C:\Users\Admin\AppData\Local\Temp\89D7.tmp"116⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\8A93.tmp"C:\Users\Admin\AppData\Local\Temp\8A93.tmp"117⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\8B6D.tmp"C:\Users\Admin\AppData\Local\Temp\8B6D.tmp"118⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"119⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"120⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\8D33.tmp"C:\Users\Admin\AppData\Local\Temp\8D33.tmp"121⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"122⤵PID:1036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-