Analysis
- max time kernel
131s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 11:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_072662abd2f33fc244d70acc4dab04f9_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_072662abd2f33fc244d70acc4dab04f9_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-15_072662abd2f33fc244d70acc4dab04f9_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260815-npsbaswva1
- SHA256 531e231ddb3edfa04e5bf78b3101ae8f0f94da57aae1a5e9022712365f2d5b44
- MD5 072662abd2f33fc244d70acc4dab04f9
- SHA1 500977785aac3b8b1e59757bdad5a6aa5f9dc214
- SHA512 f16afcd3d2a083e4490d0994c3644058c33dab222a91b4c8d7187776d5de82ef2441d00962d9312806cb801843e620fa727ff62170d71c8700385acff97108d3
- SSDEEP 12288:NU5rCOTeijhCdHFn85Fd6I5KjCT/nZReFs4XgnLTZwlH:NUQOJjodHu6I5Qkn1LTSlH
- TLSH T17EB4F1267285C133E69202710EE6EBA26D3B7C71572664C33B94677E2EB13D0A779343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3340 23E9.tmp 5140 2466.tmp 4708 262C.tmp 5048 26B8.tmp 4256 2783.tmp 3788 286E.tmp 1236 2958.tmp 2772 29F4.tmp 1512 2ACF.tmp 2008 2B9A.tmp 3472 2C56.tmp 3756 2CF2.tmp 2380 2DBD.tmp 1964 2E88.tmp 2832 2F63.tmp 1848 303E.tmp 244 30CA.tmp 828 3167.tmp 5332 3222.tmp 920 32CE.tmp 5924 3399.tmp 4616 3464.tmp 436 3500.tmp 460 356E.tmp 2284 361A.tmp 2548 3697.tmp 3408 3733.tmp 5500 37C0.tmp 2660 388B.tmp 4952 3927.tmp 3184 39B4.tmp 5808 3A5F.tmp 4672 3AEC.tmp 1736 3B69.tmp 1532 3BF6.tmp 1388 3C63.tmp 4768 3CE0.tmp 3204 3D4D.tmp 712 3DBB.tmp 2120 3E38.tmp 1400 3EB5.tmp 3156 3F32.tmp 784 3FAF.tmp 5864 404B.tmp 1332 40B8.tmp 3928 4135.tmp 4620 41E1.tmp 3372 426E.tmp 5904 42FB.tmp 3180 4378.tmp 5340 43F5.tmp 1148 4472.tmp 4556 44FE.tmp 3668 455C.tmp 912 45D9.tmp 5112 4666.tmp 4380 46E3.tmp 5756 4750.tmp 5672 47CD.tmp 896 484A.tmp 3176 48B7.tmp 1164 4915.tmp 4272 4992.tmp 2976 49FF.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 455C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9958.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B15F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 356E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1965.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E824.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3222.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F425.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4642.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 544B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D812.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 985E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 902B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F52F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 718C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F907.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7834.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E545.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96A4.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5064 wrote to memory of 3340 5064 2026-08-15_072662abd2f33fc244d70acc4dab04f9_elex_mafia_stealc_tofsee.exe 89 PID 3340 wrote to memory of 5140 3340 23E9.tmp 90 PID 5140 wrote to memory of 4708 5140 2466.tmp 91 PID 4708 wrote to memory of 5048 4708 262C.tmp 92 PID 5048 wrote to memory of 4256 5048 26B8.tmp 93 PID 4256 wrote to memory of 3788 4256 2783.tmp 94 PID 3788 wrote to memory of 1236 3788 286E.tmp 95 PID 1236 wrote to memory of 2772 1236 2958.tmp 96 PID 2772 wrote to memory of 1512 2772 29F4.tmp 97 PID 1512 wrote to memory of 2008 1512 2ACF.tmp 98 PID 2008 wrote to memory of 3472 2008 2B9A.tmp 99 PID 3472 wrote to memory of 3756 3472 2C56.tmp 100 PID 3756 wrote to memory of 2380 3756 2CF2.tmp 101 PID 2380 wrote to memory of 1964 2380 2DBD.tmp 102 PID 1964 wrote to memory of 2832 1964 2E88.tmp 103 PID 2832 wrote to memory of 1848 2832 2F63.tmp 104 PID 1848 wrote to memory of 244 1848 303E.tmp 105 PID 244 wrote to memory of 828 244 30CA.tmp 106 PID 828 wrote to memory of 5332 828 3167.tmp 107 PID 5332 wrote to memory of 920 5332 3222.tmp 108 PID 920 wrote to memory of 5924 920 32CE.tmp 109 PID 5924 wrote to memory of 4616 5924 3399.tmp 110 PID 4616 wrote to memory of 436 4616 3464.tmp 111 PID 436 wrote to memory of 460 436 3500.tmp 112 PID 460 wrote to memory of 2284 460 356E.tmp 113 PID 2284 wrote to memory of 2548 2284 361A.tmp 114 PID 2548 wrote to memory of 3408 2548 3697.tmp 115 PID 3408 wrote to memory of 5500 3408 3733.tmp 116 PID 5500 wrote to memory of 2660 5500 37C0.tmp 117 PID 2660 wrote to memory of 4952 2660 388B.tmp 118 PID 4952 wrote to memory of 3184 4952 3927.tmp 119 PID 3184 wrote to memory of 5808 3184 39B4.tmp 120 PID 5808 wrote to memory of 4672 5808 3A5F.tmp 121 PID 4672 wrote to memory of 1736 4672 3AEC.tmp 122 PID 1736 wrote to memory of 1532 1736 3B69.tmp 123 PID 1532 wrote to memory of 1388 1532 3BF6.tmp 124 PID 1388 wrote to memory of 4768 1388 3C63.tmp 125 PID 4768 wrote to memory of 3204 4768 3CE0.tmp 126 PID 3204 wrote to memory of 712 3204 3D4D.tmp 127 PID 712 wrote to memory of 2120 712 3DBB.tmp 128 PID 2120 wrote to memory of 1400 2120 3E38.tmp 129 PID 1400 wrote to memory of 3156 1400 3EB5.tmp 130 PID 3156 wrote to memory of 784 3156 3F32.tmp 131 PID 784 wrote to memory of 5864 784 3FAF.tmp 132 PID 5864 wrote to memory of 1332 5864 404B.tmp 133 PID 1332 wrote to memory of 3928 1332 40B8.tmp 134 PID 3928 wrote to memory of 4620 3928 4135.tmp 135 PID 4620 wrote to memory of 3372 4620 41E1.tmp 136 PID 3372 wrote to memory of 5904 3372 426E.tmp 137 PID 5904 wrote to memory of 3180 5904 42FB.tmp 138 PID 3180 wrote to memory of 5340 3180 4378.tmp 139 PID 5340 wrote to memory of 1148 5340 43F5.tmp 140 PID 1148 wrote to memory of 4556 1148 4472.tmp 141 PID 4556 wrote to memory of 3668 4556 44FE.tmp 142 PID 3668 wrote to memory of 912 3668 455C.tmp 143 PID 912 wrote to memory of 5112 912 45D9.tmp 144 PID 5112 wrote to memory of 4380 5112 4666.tmp 145 PID 4380 wrote to memory of 5756 4380 46E3.tmp 146 PID 5756 wrote to memory of 5672 5756 4750.tmp 147 PID 5672 wrote to memory of 896 5672 47CD.tmp 148 PID 896 wrote to memory of 3176 896 484A.tmp 149 PID 3176 wrote to memory of 1164 3176 48B7.tmp 150 PID 1164 wrote to memory of 4272 1164 4915.tmp 151 PID 4272 wrote to memory of 2976 4272 4992.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_072662abd2f33fc244d70acc4dab04f9_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_072662abd2f33fc244d70acc4dab04f9_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\23E9.tmp"C:\Users\Admin\AppData\Local\Temp\23E9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\2466.tmp"C:\Users\Admin\AppData\Local\Temp\2466.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\262C.tmp"C:\Users\Admin\AppData\Local\Temp\262C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\26B8.tmp"C:\Users\Admin\AppData\Local\Temp\26B8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\2783.tmp"C:\Users\Admin\AppData\Local\Temp\2783.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\286E.tmp"C:\Users\Admin\AppData\Local\Temp\286E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\2958.tmp"C:\Users\Admin\AppData\Local\Temp\2958.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\29F4.tmp"C:\Users\Admin\AppData\Local\Temp\29F4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"C:\Users\Admin\AppData\Local\Temp\2ACF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\2B9A.tmp"C:\Users\Admin\AppData\Local\Temp\2B9A.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\2C56.tmp"C:\Users\Admin\AppData\Local\Temp\2C56.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\2CF2.tmp"C:\Users\Admin\AppData\Local\Temp\2CF2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\2DBD.tmp"C:\Users\Admin\AppData\Local\Temp\2DBD.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\2E88.tmp"C:\Users\Admin\AppData\Local\Temp\2E88.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\2F63.tmp"C:\Users\Admin\AppData\Local\Temp\2F63.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\303E.tmp"C:\Users\Admin\AppData\Local\Temp\303E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\30CA.tmp"C:\Users\Admin\AppData\Local\Temp\30CA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\3167.tmp"C:\Users\Admin\AppData\Local\Temp\3167.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\3222.tmp"C:\Users\Admin\AppData\Local\Temp\3222.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\32CE.tmp"C:\Users\Admin\AppData\Local\Temp\32CE.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\3399.tmp"C:\Users\Admin\AppData\Local\Temp\3399.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\3464.tmp"C:\Users\Admin\AppData\Local\Temp\3464.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\3500.tmp"C:\Users\Admin\AppData\Local\Temp\3500.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\356E.tmp"C:\Users\Admin\AppData\Local\Temp\356E.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\361A.tmp"C:\Users\Admin\AppData\Local\Temp\361A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\3697.tmp"C:\Users\Admin\AppData\Local\Temp\3697.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\3733.tmp"C:\Users\Admin\AppData\Local\Temp\3733.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\37C0.tmp"C:\Users\Admin\AppData\Local\Temp\37C0.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\388B.tmp"C:\Users\Admin\AppData\Local\Temp\388B.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\3927.tmp"C:\Users\Admin\AppData\Local\Temp\3927.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\39B4.tmp"C:\Users\Admin\AppData\Local\Temp\39B4.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\3AEC.tmp"C:\Users\Admin\AppData\Local\Temp\3AEC.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\3B69.tmp"C:\Users\Admin\AppData\Local\Temp\3B69.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\3BF6.tmp"C:\Users\Admin\AppData\Local\Temp\3BF6.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\3C63.tmp"C:\Users\Admin\AppData\Local\Temp\3C63.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\3CE0.tmp"C:\Users\Admin\AppData\Local\Temp\3CE0.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\3D4D.tmp"C:\Users\Admin\AppData\Local\Temp\3D4D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\3E38.tmp"C:\Users\Admin\AppData\Local\Temp\3E38.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"C:\Users\Admin\AppData\Local\Temp\3FAF.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\404B.tmp"C:\Users\Admin\AppData\Local\Temp\404B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\40B8.tmp"C:\Users\Admin\AppData\Local\Temp\40B8.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\4135.tmp"C:\Users\Admin\AppData\Local\Temp\4135.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\41E1.tmp"C:\Users\Admin\AppData\Local\Temp\41E1.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\426E.tmp"C:\Users\Admin\AppData\Local\Temp\426E.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\42FB.tmp"C:\Users\Admin\AppData\Local\Temp\42FB.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\4378.tmp"C:\Users\Admin\AppData\Local\Temp\4378.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\43F5.tmp"C:\Users\Admin\AppData\Local\Temp\43F5.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\4472.tmp"C:\Users\Admin\AppData\Local\Temp\4472.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\44FE.tmp"C:\Users\Admin\AppData\Local\Temp\44FE.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\455C.tmp"C:\Users\Admin\AppData\Local\Temp\455C.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\45D9.tmp"C:\Users\Admin\AppData\Local\Temp\45D9.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\4666.tmp"C:\Users\Admin\AppData\Local\Temp\4666.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\46E3.tmp"C:\Users\Admin\AppData\Local\Temp\46E3.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\4750.tmp"C:\Users\Admin\AppData\Local\Temp\4750.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\47CD.tmp"C:\Users\Admin\AppData\Local\Temp\47CD.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\484A.tmp"C:\Users\Admin\AppData\Local\Temp\484A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\48B7.tmp"C:\Users\Admin\AppData\Local\Temp\48B7.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\4915.tmp"C:\Users\Admin\AppData\Local\Temp\4915.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\4992.tmp"C:\Users\Admin\AppData\Local\Temp\4992.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\49FF.tmp"C:\Users\Admin\AppData\Local\Temp\49FF.tmp"65⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"66⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\4AEA.tmp"C:\Users\Admin\AppData\Local\Temp\4AEA.tmp"67⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\4B86.tmp"C:\Users\Admin\AppData\Local\Temp\4B86.tmp"68⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\4C03.tmp"C:\Users\Admin\AppData\Local\Temp\4C03.tmp"69⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\4C80.tmp"C:\Users\Admin\AppData\Local\Temp\4C80.tmp"70⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"C:\Users\Admin\AppData\Local\Temp\4CFD.tmp"71⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\4D99.tmp"C:\Users\Admin\AppData\Local\Temp\4D99.tmp"72⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\4E26.tmp"C:\Users\Admin\AppData\Local\Temp\4E26.tmp"73⤵PID:5876
-
C:\Users\Admin\AppData\Local\Temp\4EA3.tmp"C:\Users\Admin\AppData\Local\Temp\4EA3.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\4F20.tmp"C:\Users\Admin\AppData\Local\Temp\4F20.tmp"75⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"C:\Users\Admin\AppData\Local\Temp\4F9D.tmp"76⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\501A.tmp"C:\Users\Admin\AppData\Local\Temp\501A.tmp"77⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\50B6.tmp"C:\Users\Admin\AppData\Local\Temp\50B6.tmp"78⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\5124.tmp"C:\Users\Admin\AppData\Local\Temp\5124.tmp"79⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\5191.tmp"C:\Users\Admin\AppData\Local\Temp\5191.tmp"80⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\521E.tmp"C:\Users\Admin\AppData\Local\Temp\521E.tmp"81⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\52AA.tmp"C:\Users\Admin\AppData\Local\Temp\52AA.tmp"82⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\5327.tmp"C:\Users\Admin\AppData\Local\Temp\5327.tmp"83⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\53B4.tmp"C:\Users\Admin\AppData\Local\Temp\53B4.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\5421.tmp"C:\Users\Admin\AppData\Local\Temp\5421.tmp"85⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\548F.tmp"C:\Users\Admin\AppData\Local\Temp\548F.tmp"86⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\550C.tmp"C:\Users\Admin\AppData\Local\Temp\550C.tmp"87⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\5598.tmp"C:\Users\Admin\AppData\Local\Temp\5598.tmp"88⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\5606.tmp"C:\Users\Admin\AppData\Local\Temp\5606.tmp"89⤵PID:120
-
C:\Users\Admin\AppData\Local\Temp\5683.tmp"C:\Users\Admin\AppData\Local\Temp\5683.tmp"90⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\56F0.tmp"C:\Users\Admin\AppData\Local\Temp\56F0.tmp"91⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\575D.tmp"C:\Users\Admin\AppData\Local\Temp\575D.tmp"92⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\57CB.tmp"C:\Users\Admin\AppData\Local\Temp\57CB.tmp"93⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\5857.tmp"C:\Users\Admin\AppData\Local\Temp\5857.tmp"94⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\58D4.tmp"C:\Users\Admin\AppData\Local\Temp\58D4.tmp"95⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\5961.tmp"C:\Users\Admin\AppData\Local\Temp\5961.tmp"96⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"C:\Users\Admin\AppData\Local\Temp\5A7A.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\5B07.tmp"C:\Users\Admin\AppData\Local\Temp\5B07.tmp"99⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\5B74.tmp"C:\Users\Admin\AppData\Local\Temp\5B74.tmp"100⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\5C01.tmp"C:\Users\Admin\AppData\Local\Temp\5C01.tmp"101⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\5C7E.tmp"C:\Users\Admin\AppData\Local\Temp\5C7E.tmp"102⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\5CEB.tmp"C:\Users\Admin\AppData\Local\Temp\5CEB.tmp"103⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\5D78.tmp"C:\Users\Admin\AppData\Local\Temp\5D78.tmp"104⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\5E04.tmp"C:\Users\Admin\AppData\Local\Temp\5E04.tmp"105⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\5E72.tmp"C:\Users\Admin\AppData\Local\Temp\5E72.tmp"106⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\5EEF.tmp"C:\Users\Admin\AppData\Local\Temp\5EEF.tmp"107⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"108⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\6018.tmp"C:\Users\Admin\AppData\Local\Temp\6018.tmp"109⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\6095.tmp"C:\Users\Admin\AppData\Local\Temp\6095.tmp"110⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\6131.tmp"C:\Users\Admin\AppData\Local\Temp\6131.tmp"111⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\61BE.tmp"C:\Users\Admin\AppData\Local\Temp\61BE.tmp"112⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\624A.tmp"C:\Users\Admin\AppData\Local\Temp\624A.tmp"113⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\62C7.tmp"C:\Users\Admin\AppData\Local\Temp\62C7.tmp"114⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\6344.tmp"C:\Users\Admin\AppData\Local\Temp\6344.tmp"115⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\63D1.tmp"C:\Users\Admin\AppData\Local\Temp\63D1.tmp"116⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\644E.tmp"C:\Users\Admin\AppData\Local\Temp\644E.tmp"117⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\64BB.tmp"C:\Users\Admin\AppData\Local\Temp\64BB.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"119⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\65C5.tmp"C:\Users\Admin\AppData\Local\Temp\65C5.tmp"120⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"121⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\66BF.tmp"C:\Users\Admin\AppData\Local\Temp\66BF.tmp"122⤵PID:4900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-