Analysis
- max time kernel
133s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 23:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_d46f6dcee7a496f9830078f2a5a6e4cb_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_d46f6dcee7a496f9830078f2a5a6e4cb_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-15_d46f6dcee7a496f9830078f2a5a6e4cb_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260815-21vsfsvdrf
- SHA256 5c7c6f7e319cfc6bd8e83604981ccb6d19d9472f4be38f0e47e959eeb2ea2fd4
- MD5 d46f6dcee7a496f9830078f2a5a6e4cb
- SHA1 44c6473c7debffa3201c2547de60d54b9d205473
- SHA512 eff89ee48129478a34817d336db5766bf0827146bac172660cdedaed7dc64ef309bd5354e7f14839e758352387c492defcb68732b2e60e7826cef7bc802a7d6a
- SSDEEP 12288:wU5rCOTeiD3cYKzkXdfKg3sOLbUFic+leNZ+3/v+I9hUG2VA:wUQOJD3AkSg3sOLYihleNGEA
- TLSH T17EE4D12177D88632E9FB037859B5E6645D7EBD226722D6CF2FC015AE09B1BC08631323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6752 FECD.tmp 4804 FFF6.tmp 4780 93.tmp 4468 229.tmp 1520 3CF.tmp 4324 46B.tmp 5528 575.tmp 552 65F.tmp 4964 788.tmp 6416 882.tmp 6272 9AB.tmp 6940 AA5.tmp 3720 B9F.tmp 4820 CA8.tmp 2388 DF0.tmp 3844 F19.tmp 1552 1013.tmp 5868 114C.tmp 5068 1265.tmp 5888 13BD.tmp 2496 14B7.tmp 1428 15D0.tmp 4760 16AB.tmp 1808 17E3.tmp 6404 191C.tmp 1524 1A45.tmp 2620 1B6E.tmp 7124 1CA6.tmp 5052 1DB0.tmp 4640 1EC9.tmp 4104 1FD3.tmp 3824 20DC.tmp 2744 21C7.tmp 5420 2292.tmp 6872 235D.tmp 1504 23F9.tmp 6744 2495.tmp 3952 2522.tmp 5884 25CE.tmp 3096 2689.tmp 5496 2764.tmp 6400 283F.tmp 5412 290A.tmp 1760 2A23.tmp 2628 2ACF.tmp 6760 2BAA.tmp 6840 2C65.tmp 2432 2D40.tmp 7140 2DEC.tmp 6992 2E59.tmp 2452 2EE6.tmp 6520 2F63.tmp 2152 2FE0.tmp 6536 306D.tmp 6988 3118.tmp 2860 3176.tmp 4152 3203.tmp 5380 3270.tmp 2288 330C.tmp 2056 3389.tmp 6444 3416.tmp 2624 34B2.tmp 6888 353F.tmp 1972 35CC.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8454.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C804.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6901.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D013.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A61A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1265.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8246.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 447C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6013.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 235D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A50B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8023.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F543.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F09B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 474B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1013.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C068.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3922.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3649.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D812.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 428D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 643E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 6464 wrote to memory of 6752 6464 2026-08-15_d46f6dcee7a496f9830078f2a5a6e4cb_elex_mafia_stealc_tofsee.exe 90 PID 6752 wrote to memory of 4804 6752 FECD.tmp 91 PID 4804 wrote to memory of 4780 4804 FFF6.tmp 92 PID 4780 wrote to memory of 4468 4780 93.tmp 93 PID 4468 wrote to memory of 1520 4468 229.tmp 94 PID 1520 wrote to memory of 4324 1520 3CF.tmp 95 PID 4324 wrote to memory of 5528 4324 46B.tmp 96 PID 5528 wrote to memory of 552 5528 575.tmp 97 PID 552 wrote to memory of 4964 552 65F.tmp 98 PID 4964 wrote to memory of 6416 4964 788.tmp 99 PID 6416 wrote to memory of 6272 6416 882.tmp 100 PID 6272 wrote to memory of 6940 6272 9AB.tmp 101 PID 6940 wrote to memory of 3720 6940 AA5.tmp 102 PID 3720 wrote to memory of 4820 3720 B9F.tmp 103 PID 4820 wrote to memory of 2388 4820 CA8.tmp 104 PID 2388 wrote to memory of 3844 2388 DF0.tmp 105 PID 3844 wrote to memory of 1552 3844 F19.tmp 106 PID 1552 wrote to memory of 5868 1552 1013.tmp 107 PID 5868 wrote to memory of 5068 5868 114C.tmp 108 PID 5068 wrote to memory of 5888 5068 1265.tmp 109 PID 5888 wrote to memory of 2496 5888 13BD.tmp 110 PID 2496 wrote to memory of 1428 2496 14B7.tmp 111 PID 1428 wrote to memory of 4760 1428 15D0.tmp 112 PID 4760 wrote to memory of 1808 4760 16AB.tmp 113 PID 1808 wrote to memory of 6404 1808 17E3.tmp 114 PID 6404 wrote to memory of 1524 6404 191C.tmp 115 PID 1524 wrote to memory of 2620 1524 1A45.tmp 116 PID 2620 wrote to memory of 7124 2620 1B6E.tmp 117 PID 7124 wrote to memory of 5052 7124 1CA6.tmp 118 PID 5052 wrote to memory of 4640 5052 1DB0.tmp 119 PID 4640 wrote to memory of 4104 4640 1EC9.tmp 120 PID 4104 wrote to memory of 3824 4104 1FD3.tmp 121 PID 3824 wrote to memory of 2744 3824 20DC.tmp 122 PID 2744 wrote to memory of 5420 2744 21C7.tmp 123 PID 5420 wrote to memory of 6872 5420 2292.tmp 124 PID 6872 wrote to memory of 1504 6872 235D.tmp 125 PID 1504 wrote to memory of 6744 1504 23F9.tmp 126 PID 6744 wrote to memory of 3952 6744 2495.tmp 127 PID 3952 wrote to memory of 5884 3952 2522.tmp 128 PID 5884 wrote to memory of 3096 5884 25CE.tmp 129 PID 3096 wrote to memory of 5496 3096 2689.tmp 130 PID 5496 wrote to memory of 6400 5496 2764.tmp 131 PID 6400 wrote to memory of 5412 6400 283F.tmp 132 PID 5412 wrote to memory of 1760 5412 290A.tmp 133 PID 1760 wrote to memory of 2628 1760 2A23.tmp 134 PID 2628 wrote to memory of 6760 2628 2ACF.tmp 135 PID 6760 wrote to memory of 6840 6760 2BAA.tmp 136 PID 6840 wrote to memory of 2432 6840 2C65.tmp 137 PID 2432 wrote to memory of 7140 2432 2D40.tmp 138 PID 7140 wrote to memory of 6992 7140 2DEC.tmp 139 PID 6992 wrote to memory of 2452 6992 2E59.tmp 140 PID 2452 wrote to memory of 6520 2452 2EE6.tmp 141 PID 6520 wrote to memory of 2152 6520 2F63.tmp 142 PID 2152 wrote to memory of 6536 2152 2FE0.tmp 143 PID 6536 wrote to memory of 6988 6536 306D.tmp 144 PID 6988 wrote to memory of 2860 6988 3118.tmp 145 PID 2860 wrote to memory of 4152 2860 3176.tmp 146 PID 4152 wrote to memory of 5380 4152 3203.tmp 147 PID 5380 wrote to memory of 2288 5380 3270.tmp 148 PID 2288 wrote to memory of 2056 2288 330C.tmp 149 PID 2056 wrote to memory of 6444 2056 3389.tmp 150 PID 6444 wrote to memory of 2624 6444 3416.tmp 151 PID 2624 wrote to memory of 6888 2624 34B2.tmp 152 PID 6888 wrote to memory of 1972 6888 353F.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_d46f6dcee7a496f9830078f2a5a6e4cb_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_d46f6dcee7a496f9830078f2a5a6e4cb_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6464 -
C:\Users\Admin\AppData\Local\Temp\FECD.tmp"C:\Users\Admin\AppData\Local\Temp\FECD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6752 -
C:\Users\Admin\AppData\Local\Temp\FFF6.tmp"C:\Users\Admin\AppData\Local\Temp\FFF6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\93.tmp"C:\Users\Admin\AppData\Local\Temp\93.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\229.tmp"C:\Users\Admin\AppData\Local\Temp\229.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\3CF.tmp"C:\Users\Admin\AppData\Local\Temp\3CF.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\46B.tmp"C:\Users\Admin\AppData\Local\Temp\46B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\575.tmp"C:\Users\Admin\AppData\Local\Temp\575.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\65F.tmp"C:\Users\Admin\AppData\Local\Temp\65F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\788.tmp"C:\Users\Admin\AppData\Local\Temp\788.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\882.tmp"C:\Users\Admin\AppData\Local\Temp\882.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6416 -
C:\Users\Admin\AppData\Local\Temp\9AB.tmp"C:\Users\Admin\AppData\Local\Temp\9AB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6272 -
C:\Users\Admin\AppData\Local\Temp\AA5.tmp"C:\Users\Admin\AppData\Local\Temp\AA5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6940 -
C:\Users\Admin\AppData\Local\Temp\B9F.tmp"C:\Users\Admin\AppData\Local\Temp\B9F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\CA8.tmp"C:\Users\Admin\AppData\Local\Temp\CA8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\DF0.tmp"C:\Users\Admin\AppData\Local\Temp\DF0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\F19.tmp"C:\Users\Admin\AppData\Local\Temp\F19.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\1013.tmp"C:\Users\Admin\AppData\Local\Temp\1013.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\114C.tmp"C:\Users\Admin\AppData\Local\Temp\114C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\1265.tmp"C:\Users\Admin\AppData\Local\Temp\1265.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\13BD.tmp"C:\Users\Admin\AppData\Local\Temp\13BD.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\14B7.tmp"C:\Users\Admin\AppData\Local\Temp\14B7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\15D0.tmp"C:\Users\Admin\AppData\Local\Temp\15D0.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\16AB.tmp"C:\Users\Admin\AppData\Local\Temp\16AB.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\17E3.tmp"C:\Users\Admin\AppData\Local\Temp\17E3.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6404 -
C:\Users\Admin\AppData\Local\Temp\1A45.tmp"C:\Users\Admin\AppData\Local\Temp\1A45.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\1B6E.tmp"C:\Users\Admin\AppData\Local\Temp\1B6E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\1CA6.tmp"C:\Users\Admin\AppData\Local\Temp\1CA6.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7124 -
C:\Users\Admin\AppData\Local\Temp\1DB0.tmp"C:\Users\Admin\AppData\Local\Temp\1DB0.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\1EC9.tmp"C:\Users\Admin\AppData\Local\Temp\1EC9.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\1FD3.tmp"C:\Users\Admin\AppData\Local\Temp\1FD3.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\20DC.tmp"C:\Users\Admin\AppData\Local\Temp\20DC.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\21C7.tmp"C:\Users\Admin\AppData\Local\Temp\21C7.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\2292.tmp"C:\Users\Admin\AppData\Local\Temp\2292.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\235D.tmp"C:\Users\Admin\AppData\Local\Temp\235D.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6872 -
C:\Users\Admin\AppData\Local\Temp\23F9.tmp"C:\Users\Admin\AppData\Local\Temp\23F9.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\2495.tmp"C:\Users\Admin\AppData\Local\Temp\2495.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6744 -
C:\Users\Admin\AppData\Local\Temp\2522.tmp"C:\Users\Admin\AppData\Local\Temp\2522.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\25CE.tmp"C:\Users\Admin\AppData\Local\Temp\25CE.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\2689.tmp"C:\Users\Admin\AppData\Local\Temp\2689.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\2764.tmp"C:\Users\Admin\AppData\Local\Temp\2764.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\283F.tmp"C:\Users\Admin\AppData\Local\Temp\283F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6400 -
C:\Users\Admin\AppData\Local\Temp\290A.tmp"C:\Users\Admin\AppData\Local\Temp\290A.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\2A23.tmp"C:\Users\Admin\AppData\Local\Temp\2A23.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\2BAA.tmp"C:\Users\Admin\AppData\Local\Temp\2BAA.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6760 -
C:\Users\Admin\AppData\Local\Temp\2C65.tmp"C:\Users\Admin\AppData\Local\Temp\2C65.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6840 -
C:\Users\Admin\AppData\Local\Temp\2D40.tmp"C:\Users\Admin\AppData\Local\Temp\2D40.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\2DEC.tmp"C:\Users\Admin\AppData\Local\Temp\2DEC.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7140 -
C:\Users\Admin\AppData\Local\Temp\2E59.tmp"C:\Users\Admin\AppData\Local\Temp\2E59.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6992 -
C:\Users\Admin\AppData\Local\Temp\2EE6.tmp"C:\Users\Admin\AppData\Local\Temp\2EE6.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\2F63.tmp"C:\Users\Admin\AppData\Local\Temp\2F63.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6520 -
C:\Users\Admin\AppData\Local\Temp\2FE0.tmp"C:\Users\Admin\AppData\Local\Temp\2FE0.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\306D.tmp"C:\Users\Admin\AppData\Local\Temp\306D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6536 -
C:\Users\Admin\AppData\Local\Temp\3118.tmp"C:\Users\Admin\AppData\Local\Temp\3118.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6988 -
C:\Users\Admin\AppData\Local\Temp\3176.tmp"C:\Users\Admin\AppData\Local\Temp\3176.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\3203.tmp"C:\Users\Admin\AppData\Local\Temp\3203.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\3270.tmp"C:\Users\Admin\AppData\Local\Temp\3270.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\330C.tmp"C:\Users\Admin\AppData\Local\Temp\330C.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\3389.tmp"C:\Users\Admin\AppData\Local\Temp\3389.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\3416.tmp"C:\Users\Admin\AppData\Local\Temp\3416.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6444 -
C:\Users\Admin\AppData\Local\Temp\34B2.tmp"C:\Users\Admin\AppData\Local\Temp\34B2.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\353F.tmp"C:\Users\Admin\AppData\Local\Temp\353F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6888 -
C:\Users\Admin\AppData\Local\Temp\35CC.tmp"C:\Users\Admin\AppData\Local\Temp\35CC.tmp"65⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3649.tmp"C:\Users\Admin\AppData\Local\Temp\3649.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\36C6.tmp"C:\Users\Admin\AppData\Local\Temp\36C6.tmp"67⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\3733.tmp"C:\Users\Admin\AppData\Local\Temp\3733.tmp"68⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\37C0.tmp"C:\Users\Admin\AppData\Local\Temp\37C0.tmp"69⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\383D.tmp"C:\Users\Admin\AppData\Local\Temp\383D.tmp"70⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\38C9.tmp"C:\Users\Admin\AppData\Local\Temp\38C9.tmp"71⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\3946.tmp"C:\Users\Admin\AppData\Local\Temp\3946.tmp"72⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\39D3.tmp"C:\Users\Admin\AppData\Local\Temp\39D3.tmp"73⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\3A50.tmp"C:\Users\Admin\AppData\Local\Temp\3A50.tmp"74⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\3ADC.tmp"C:\Users\Admin\AppData\Local\Temp\3ADC.tmp"75⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\3B69.tmp"C:\Users\Admin\AppData\Local\Temp\3B69.tmp"76⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\3BD6.tmp"C:\Users\Admin\AppData\Local\Temp\3BD6.tmp"77⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\3C63.tmp"C:\Users\Admin\AppData\Local\Temp\3C63.tmp"78⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\3CFF.tmp"C:\Users\Admin\AppData\Local\Temp\3CFF.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\3D8C.tmp"C:\Users\Admin\AppData\Local\Temp\3D8C.tmp"80⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"81⤵PID:7096
-
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"82⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"83⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\3F90.tmp"C:\Users\Admin\AppData\Local\Temp\3F90.tmp"84⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"85⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\4099.tmp"C:\Users\Admin\AppData\Local\Temp\4099.tmp"86⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"87⤵PID:6608
-
C:\Users\Admin\AppData\Local\Temp\4193.tmp"C:\Users\Admin\AppData\Local\Temp\4193.tmp"88⤵PID:6728
-
C:\Users\Admin\AppData\Local\Temp\4220.tmp"C:\Users\Admin\AppData\Local\Temp\4220.tmp"89⤵PID:6796
-
C:\Users\Admin\AppData\Local\Temp\428D.tmp"C:\Users\Admin\AppData\Local\Temp\428D.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\430A.tmp"C:\Users\Admin\AppData\Local\Temp\430A.tmp"91⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\4387.tmp"C:\Users\Admin\AppData\Local\Temp\4387.tmp"92⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\43F5.tmp"C:\Users\Admin\AppData\Local\Temp\43F5.tmp"93⤵PID:472
-
C:\Users\Admin\AppData\Local\Temp\4472.tmp"C:\Users\Admin\AppData\Local\Temp\4472.tmp"94⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\44EF.tmp"C:\Users\Admin\AppData\Local\Temp\44EF.tmp"95⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\456C.tmp"C:\Users\Admin\AppData\Local\Temp\456C.tmp"96⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\45D9.tmp"C:\Users\Admin\AppData\Local\Temp\45D9.tmp"97⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\4646.tmp"C:\Users\Admin\AppData\Local\Temp\4646.tmp"98⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\46D3.tmp"C:\Users\Admin\AppData\Local\Temp\46D3.tmp"99⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\4760.tmp"C:\Users\Admin\AppData\Local\Temp\4760.tmp"100⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\47DD.tmp"C:\Users\Admin\AppData\Local\Temp\47DD.tmp"101⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\484A.tmp"C:\Users\Admin\AppData\Local\Temp\484A.tmp"102⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\48D7.tmp"C:\Users\Admin\AppData\Local\Temp\48D7.tmp"103⤵PID:6876
-
C:\Users\Admin\AppData\Local\Temp\4954.tmp"C:\Users\Admin\AppData\Local\Temp\4954.tmp"104⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\49F0.tmp"C:\Users\Admin\AppData\Local\Temp\49F0.tmp"105⤵PID:6972
-
C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"C:\Users\Admin\AppData\Local\Temp\4A6D.tmp"106⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\4AF9.tmp"C:\Users\Admin\AppData\Local\Temp\4AF9.tmp"107⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\4B86.tmp"C:\Users\Admin\AppData\Local\Temp\4B86.tmp"108⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\4C32.tmp"C:\Users\Admin\AppData\Local\Temp\4C32.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\4CCE.tmp"C:\Users\Admin\AppData\Local\Temp\4CCE.tmp"110⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\4D6A.tmp"C:\Users\Admin\AppData\Local\Temp\4D6A.tmp"111⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\4DE7.tmp"C:\Users\Admin\AppData\Local\Temp\4DE7.tmp"112⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\4E84.tmp"C:\Users\Admin\AppData\Local\Temp\4E84.tmp"113⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\4F10.tmp"C:\Users\Admin\AppData\Local\Temp\4F10.tmp"114⤵PID:6500
-
C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\502A.tmp"C:\Users\Admin\AppData\Local\Temp\502A.tmp"116⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\50B6.tmp"C:\Users\Admin\AppData\Local\Temp\50B6.tmp"117⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\5133.tmp"C:\Users\Admin\AppData\Local\Temp\5133.tmp"118⤵PID:6288
-
C:\Users\Admin\AppData\Local\Temp\51CF.tmp"C:\Users\Admin\AppData\Local\Temp\51CF.tmp"119⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\525C.tmp"C:\Users\Admin\AppData\Local\Temp\525C.tmp"120⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\52F8.tmp"C:\Users\Admin\AppData\Local\Temp\52F8.tmp"121⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\5395.tmp"C:\Users\Admin\AppData\Local\Temp\5395.tmp"122⤵PID:3364
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-