Analysis
- max time kernel
130s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 03:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-17_91532684e071eb94917c68e64cfd3772_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_91532684e071eb94917c68e64cfd3772_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-17_91532684e071eb94917c68e64cfd3772_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260817-d3ay3adr71
- SHA256 1767a787e2b9279ebf3b32a769340d4493b788480cda0f1017ef24d5f51d5855
- MD5 91532684e071eb94917c68e64cfd3772
- SHA1 03c4265bf851b3fb64ab8a70d164582e3ebede4b
- SHA512 7967af3802cac5a83f75279800ecdf1d3450ae614e825231d90877cfdd8717cbc0c5c7891637e5b1a049f646d993a2ba0048a8a4ff690b897d794ed409967ae4
- SSDEEP 12288:wU5rCOTeiDdTaGvgBcEASZCPJX1kHHBNZ+3/v+I9hUG2VA:wUQOJDlaumcVh5EHBNGEA
- TLSH T147E4D12173D88532E5F7037859B5E6654E7EBD32A722D6CF2F8016AE0971BD08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5580 209E.tmp 3400 21B7.tmp 2152 24D4.tmp 1088 261C.tmp 3388 2706.tmp 1624 27F1.tmp 3260 290A.tmp 4216 2A04.tmp 2100 2B1D.tmp 2092 2BF8.tmp 2268 2D50.tmp 1444 2E3A.tmp 3552 2F05.tmp 3364 304D.tmp 292 3186.tmp 3800 32AF.tmp 3528 33C8.tmp 2780 34E1.tmp 5192 360A.tmp 5272 3704.tmp 5668 383D.tmp 5796 3965.tmp 2412 3A8E.tmp 3068 3BC7.tmp 4844 3CB1.tmp 2672 3D8C.tmp 2928 3E86.tmp 2312 3F61.tmp 5896 407A.tmp 4272 4174.tmp 6080 427E.tmp 3916 4378.tmp 1052 44A0.tmp 3380 454C.tmp 2972 4608.tmp 1708 46A4.tmp 4500 4740.tmp 5916 47DD.tmp 864 4869.tmp 1700 4905.tmp 2912 49D1.tmp 4984 4A7C.tmp 2360 4B57.tmp 2548 4C03.tmp 4472 4CDE.tmp 4868 4D8A.tmp 4552 4E74.tmp 4560 4F3F.tmp 6048 4FCC.tmp 4644 5058.tmp 2868 50D5.tmp 900 5143.tmp 5116 51C0.tmp 3520 522D.tmp 4192 52BA.tmp 4212 5346.tmp 6028 53F2.tmp 1552 546F.tmp 2908 550C.tmp 2768 55A8.tmp 5820 5634.tmp 5936 56B1.tmp 2756 572E.tmp 3692 57BB.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B982.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 565F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1653.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D632.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F399.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 771A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E40D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6802.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B69F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E744.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 205A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 613C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-17_91532684e071eb94917c68e64cfd3772_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 351B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7546.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3615.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 592D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6301.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8118.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 461.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 839D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7408.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9282.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4356 wrote to memory of 5580 4356 2026-08-17_91532684e071eb94917c68e64cfd3772_elex_mafia_stealc_tofsee.exe 89 PID 5580 wrote to memory of 3400 5580 209E.tmp 90 PID 3400 wrote to memory of 2152 3400 21B7.tmp 91 PID 2152 wrote to memory of 1088 2152 24D4.tmp 92 PID 1088 wrote to memory of 3388 1088 261C.tmp 93 PID 3388 wrote to memory of 1624 3388 2706.tmp 94 PID 1624 wrote to memory of 3260 1624 27F1.tmp 95 PID 3260 wrote to memory of 4216 3260 290A.tmp 96 PID 4216 wrote to memory of 2100 4216 2A04.tmp 97 PID 2100 wrote to memory of 2092 2100 2B1D.tmp 98 PID 2092 wrote to memory of 2268 2092 2BF8.tmp 99 PID 2268 wrote to memory of 1444 2268 2D50.tmp 100 PID 1444 wrote to memory of 3552 1444 2E3A.tmp 101 PID 3552 wrote to memory of 3364 3552 2F05.tmp 102 PID 3364 wrote to memory of 292 3364 304D.tmp 103 PID 292 wrote to memory of 3800 292 3186.tmp 104 PID 3800 wrote to memory of 3528 3800 32AF.tmp 105 PID 3528 wrote to memory of 2780 3528 33C8.tmp 106 PID 2780 wrote to memory of 5192 2780 34E1.tmp 107 PID 5192 wrote to memory of 5272 5192 360A.tmp 108 PID 5272 wrote to memory of 5668 5272 3704.tmp 109 PID 5668 wrote to memory of 5796 5668 383D.tmp 110 PID 5796 wrote to memory of 2412 5796 3965.tmp 111 PID 2412 wrote to memory of 3068 2412 3A8E.tmp 112 PID 3068 wrote to memory of 4844 3068 3BC7.tmp 113 PID 4844 wrote to memory of 2672 4844 3CB1.tmp 114 PID 2672 wrote to memory of 2928 2672 3D8C.tmp 115 PID 2928 wrote to memory of 2312 2928 3E86.tmp 116 PID 2312 wrote to memory of 5896 2312 3F61.tmp 117 PID 5896 wrote to memory of 4272 5896 407A.tmp 118 PID 4272 wrote to memory of 6080 4272 4174.tmp 119 PID 6080 wrote to memory of 3916 6080 427E.tmp 120 PID 3916 wrote to memory of 1052 3916 4378.tmp 121 PID 1052 wrote to memory of 3380 1052 44A0.tmp 122 PID 3380 wrote to memory of 2972 3380 454C.tmp 123 PID 2972 wrote to memory of 1708 2972 4608.tmp 124 PID 1708 wrote to memory of 4500 1708 46A4.tmp 125 PID 4500 wrote to memory of 5916 4500 4740.tmp 126 PID 5916 wrote to memory of 864 5916 47DD.tmp 127 PID 864 wrote to memory of 1700 864 4869.tmp 128 PID 1700 wrote to memory of 2912 1700 4905.tmp 129 PID 2912 wrote to memory of 4984 2912 49D1.tmp 130 PID 4984 wrote to memory of 2360 4984 4A7C.tmp 131 PID 2360 wrote to memory of 2548 2360 4B57.tmp 132 PID 2548 wrote to memory of 4472 2548 4C03.tmp 133 PID 4472 wrote to memory of 4868 4472 4CDE.tmp 134 PID 4868 wrote to memory of 4552 4868 4D8A.tmp 135 PID 4552 wrote to memory of 4560 4552 4E74.tmp 136 PID 4560 wrote to memory of 6048 4560 4F3F.tmp 137 PID 6048 wrote to memory of 4644 6048 4FCC.tmp 138 PID 4644 wrote to memory of 2868 4644 5058.tmp 139 PID 2868 wrote to memory of 900 2868 50D5.tmp 140 PID 900 wrote to memory of 5116 900 5143.tmp 141 PID 5116 wrote to memory of 3520 5116 51C0.tmp 142 PID 3520 wrote to memory of 4192 3520 522D.tmp 143 PID 4192 wrote to memory of 4212 4192 52BA.tmp 144 PID 4212 wrote to memory of 6028 4212 5346.tmp 145 PID 6028 wrote to memory of 1552 6028 53F2.tmp 146 PID 1552 wrote to memory of 2908 1552 546F.tmp 147 PID 2908 wrote to memory of 2768 2908 550C.tmp 148 PID 2768 wrote to memory of 5820 2768 55A8.tmp 149 PID 5820 wrote to memory of 5936 5820 5634.tmp 150 PID 5936 wrote to memory of 2756 5936 56B1.tmp 151 PID 2756 wrote to memory of 3692 2756 572E.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_91532684e071eb94917c68e64cfd3772_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_91532684e071eb94917c68e64cfd3772_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\209E.tmp"C:\Users\Admin\AppData\Local\Temp\209E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\21B7.tmp"C:\Users\Admin\AppData\Local\Temp\21B7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\24D4.tmp"C:\Users\Admin\AppData\Local\Temp\24D4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\261C.tmp"C:\Users\Admin\AppData\Local\Temp\261C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\2706.tmp"C:\Users\Admin\AppData\Local\Temp\2706.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\27F1.tmp"C:\Users\Admin\AppData\Local\Temp\27F1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\290A.tmp"C:\Users\Admin\AppData\Local\Temp\290A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\2A04.tmp"C:\Users\Admin\AppData\Local\Temp\2A04.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\2BF8.tmp"C:\Users\Admin\AppData\Local\Temp\2BF8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\2D50.tmp"C:\Users\Admin\AppData\Local\Temp\2D50.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\2E3A.tmp"C:\Users\Admin\AppData\Local\Temp\2E3A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\2F05.tmp"C:\Users\Admin\AppData\Local\Temp\2F05.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\304D.tmp"C:\Users\Admin\AppData\Local\Temp\304D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\3186.tmp"C:\Users\Admin\AppData\Local\Temp\3186.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Users\Admin\AppData\Local\Temp\32AF.tmp"C:\Users\Admin\AppData\Local\Temp\32AF.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\33C8.tmp"C:\Users\Admin\AppData\Local\Temp\33C8.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\34E1.tmp"C:\Users\Admin\AppData\Local\Temp\34E1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\360A.tmp"C:\Users\Admin\AppData\Local\Temp\360A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Users\Admin\AppData\Local\Temp\3704.tmp"C:\Users\Admin\AppData\Local\Temp\3704.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\383D.tmp"C:\Users\Admin\AppData\Local\Temp\383D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\3965.tmp"C:\Users\Admin\AppData\Local\Temp\3965.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\3A8E.tmp"C:\Users\Admin\AppData\Local\Temp\3A8E.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\3BC7.tmp"C:\Users\Admin\AppData\Local\Temp\3BC7.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\3CB1.tmp"C:\Users\Admin\AppData\Local\Temp\3CB1.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\3D8C.tmp"C:\Users\Admin\AppData\Local\Temp\3D8C.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\4174.tmp"C:\Users\Admin\AppData\Local\Temp\4174.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\427E.tmp"C:\Users\Admin\AppData\Local\Temp\427E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\4378.tmp"C:\Users\Admin\AppData\Local\Temp\4378.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\44A0.tmp"C:\Users\Admin\AppData\Local\Temp\44A0.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\454C.tmp"C:\Users\Admin\AppData\Local\Temp\454C.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\4608.tmp"C:\Users\Admin\AppData\Local\Temp\4608.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\46A4.tmp"C:\Users\Admin\AppData\Local\Temp\46A4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\4740.tmp"C:\Users\Admin\AppData\Local\Temp\4740.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\47DD.tmp"C:\Users\Admin\AppData\Local\Temp\47DD.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\4869.tmp"C:\Users\Admin\AppData\Local\Temp\4869.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\4905.tmp"C:\Users\Admin\AppData\Local\Temp\4905.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\49D1.tmp"C:\Users\Admin\AppData\Local\Temp\49D1.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"C:\Users\Admin\AppData\Local\Temp\4A7C.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\4B57.tmp"C:\Users\Admin\AppData\Local\Temp\4B57.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\4C03.tmp"C:\Users\Admin\AppData\Local\Temp\4C03.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\4CDE.tmp"C:\Users\Admin\AppData\Local\Temp\4CDE.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\4D8A.tmp"C:\Users\Admin\AppData\Local\Temp\4D8A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\4E74.tmp"C:\Users\Admin\AppData\Local\Temp\4E74.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\4F3F.tmp"C:\Users\Admin\AppData\Local\Temp\4F3F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\4FCC.tmp"C:\Users\Admin\AppData\Local\Temp\4FCC.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\5058.tmp"C:\Users\Admin\AppData\Local\Temp\5058.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\50D5.tmp"C:\Users\Admin\AppData\Local\Temp\50D5.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\5143.tmp"C:\Users\Admin\AppData\Local\Temp\5143.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\51C0.tmp"C:\Users\Admin\AppData\Local\Temp\51C0.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\522D.tmp"C:\Users\Admin\AppData\Local\Temp\522D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\52BA.tmp"C:\Users\Admin\AppData\Local\Temp\52BA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\5346.tmp"C:\Users\Admin\AppData\Local\Temp\5346.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\53F2.tmp"C:\Users\Admin\AppData\Local\Temp\53F2.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\546F.tmp"C:\Users\Admin\AppData\Local\Temp\546F.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\550C.tmp"C:\Users\Admin\AppData\Local\Temp\550C.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\55A8.tmp"C:\Users\Admin\AppData\Local\Temp\55A8.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\5634.tmp"C:\Users\Admin\AppData\Local\Temp\5634.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\56B1.tmp"C:\Users\Admin\AppData\Local\Temp\56B1.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\572E.tmp"C:\Users\Admin\AppData\Local\Temp\572E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\57BB.tmp"C:\Users\Admin\AppData\Local\Temp\57BB.tmp"65⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\5838.tmp"C:\Users\Admin\AppData\Local\Temp\5838.tmp"66⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\58B5.tmp"C:\Users\Admin\AppData\Local\Temp\58B5.tmp"67⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\5922.tmp"C:\Users\Admin\AppData\Local\Temp\5922.tmp"68⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\5990.tmp"C:\Users\Admin\AppData\Local\Temp\5990.tmp"69⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:352 -
C:\Users\Admin\AppData\Local\Temp\5A99.tmp"C:\Users\Admin\AppData\Local\Temp\5A99.tmp"71⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\5B26.tmp"C:\Users\Admin\AppData\Local\Temp\5B26.tmp"72⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\5BA3.tmp"C:\Users\Admin\AppData\Local\Temp\5BA3.tmp"73⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\5C10.tmp"C:\Users\Admin\AppData\Local\Temp\5C10.tmp"74⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\5C7E.tmp"C:\Users\Admin\AppData\Local\Temp\5C7E.tmp"75⤵PID:5240
-
C:\Users\Admin\AppData\Local\Temp\5D0A.tmp"C:\Users\Admin\AppData\Local\Temp\5D0A.tmp"76⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\5D97.tmp"C:\Users\Admin\AppData\Local\Temp\5D97.tmp"77⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\5E14.tmp"C:\Users\Admin\AppData\Local\Temp\5E14.tmp"78⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\5E81.tmp"C:\Users\Admin\AppData\Local\Temp\5E81.tmp"79⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\5EFE.tmp"C:\Users\Admin\AppData\Local\Temp\5EFE.tmp"80⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\5F8B.tmp"C:\Users\Admin\AppData\Local\Temp\5F8B.tmp"81⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\6008.tmp"C:\Users\Admin\AppData\Local\Temp\6008.tmp"82⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\6085.tmp"C:\Users\Admin\AppData\Local\Temp\6085.tmp"83⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\60F2.tmp"C:\Users\Admin\AppData\Local\Temp\60F2.tmp"84⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\6160.tmp"C:\Users\Admin\AppData\Local\Temp\6160.tmp"85⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\61DD.tmp"C:\Users\Admin\AppData\Local\Temp\61DD.tmp"86⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\625A.tmp"C:\Users\Admin\AppData\Local\Temp\625A.tmp"87⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\62D7.tmp"C:\Users\Admin\AppData\Local\Temp\62D7.tmp"88⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\6373.tmp"C:\Users\Admin\AppData\Local\Temp\6373.tmp"89⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\63F0.tmp"C:\Users\Admin\AppData\Local\Temp\63F0.tmp"90⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\647D.tmp"C:\Users\Admin\AppData\Local\Temp\647D.tmp"91⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\6509.tmp"C:\Users\Admin\AppData\Local\Temp\6509.tmp"92⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\6577.tmp"C:\Users\Admin\AppData\Local\Temp\6577.tmp"93⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\65F4.tmp"C:\Users\Admin\AppData\Local\Temp\65F4.tmp"94⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"95⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\66CE.tmp"C:\Users\Admin\AppData\Local\Temp\66CE.tmp"96⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\675B.tmp"C:\Users\Admin\AppData\Local\Temp\675B.tmp"97⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"98⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\6836.tmp"C:\Users\Admin\AppData\Local\Temp\6836.tmp"99⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\68C2.tmp"C:\Users\Admin\AppData\Local\Temp\68C2.tmp"100⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\693F.tmp"C:\Users\Admin\AppData\Local\Temp\693F.tmp"101⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\69AD.tmp"C:\Users\Admin\AppData\Local\Temp\69AD.tmp"102⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\6A2A.tmp"C:\Users\Admin\AppData\Local\Temp\6A2A.tmp"103⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\6AA7.tmp"C:\Users\Admin\AppData\Local\Temp\6AA7.tmp"104⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\6B24.tmp"C:\Users\Admin\AppData\Local\Temp\6B24.tmp"105⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\6BC0.tmp"C:\Users\Admin\AppData\Local\Temp\6BC0.tmp"106⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"C:\Users\Admin\AppData\Local\Temp\6C3D.tmp"107⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"108⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\6D37.tmp"C:\Users\Admin\AppData\Local\Temp\6D37.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\6DC4.tmp"C:\Users\Admin\AppData\Local\Temp\6DC4.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\6E21.tmp"C:\Users\Admin\AppData\Local\Temp\6E21.tmp"111⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\6EAE.tmp"C:\Users\Admin\AppData\Local\Temp\6EAE.tmp"112⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\6F4A.tmp"C:\Users\Admin\AppData\Local\Temp\6F4A.tmp"113⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\6FD7.tmp"C:\Users\Admin\AppData\Local\Temp\6FD7.tmp"114⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\7044.tmp"C:\Users\Admin\AppData\Local\Temp\7044.tmp"115⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\70C1.tmp"C:\Users\Admin\AppData\Local\Temp\70C1.tmp"116⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\714E.tmp"C:\Users\Admin\AppData\Local\Temp\714E.tmp"117⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\71BB.tmp"C:\Users\Admin\AppData\Local\Temp\71BB.tmp"118⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\7238.tmp"C:\Users\Admin\AppData\Local\Temp\7238.tmp"119⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\72D5.tmp"C:\Users\Admin\AppData\Local\Temp\72D5.tmp"120⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\7361.tmp"C:\Users\Admin\AppData\Local\Temp\7361.tmp"121⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\73DE.tmp"C:\Users\Admin\AppData\Local\Temp\73DE.tmp"122⤵PID:2992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-