Analysis
- max time kernel
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 04:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_0859cd59c6df1fda198b893c188516fa_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_0859cd59c6df1fda198b893c188516fa_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-22_0859cd59c6df1fda198b893c188516fa_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260822-fdft5aeq9w
- SHA256 d4471085c07b20d95b7f9ea00082f90fe90f7ff764980ff1a731a34a6b399a6f
- MD5 0859cd59c6df1fda198b893c188516fa
- SHA1 adc32b9a2f6dbab957f4532ba56253f95ae36c45
- SHA512 c62acf4b35ff26bfa0d2b0394ff724243a7b29a76a3790cbdf6a202a422311ca69e4f14eb09deba483ad859233ebf2b39ca0b2a5e7238d40a6179acaebb4fa7b
- SSDEEP 12288:wU5rCOTeiDN1p9NvjuHIGq+4+niNZ+3/v+I9hUG2VA:wUQOJDHp9NLHyniNGEA
- TLSH T12FE4D12173D88532E5FB037859B9E6604D7EBD36A722D6CF2F9055AE0971BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5020 48B7.tmp 2416 4954.tmp 6128 49D1.tmp 4328 4B67.tmp 3468 4CAF.tmp 4784 4D4B.tmp 4376 4E55.tmp 4236 4F5E.tmp 1064 5058.tmp 4252 5162.tmp 360 524C.tmp 4196 5366.tmp 4880 546F.tmp 3636 552B.tmp 3532 5654.tmp 2232 573E.tmp 4964 5819.tmp 2816 58E4.tmp 4980 5A0D.tmp 5204 5B26.tmp 1152 5BF1.tmp 796 5CCC.tmp 5000 5D97.tmp 4800 5E72.tmp 2632 5F7B.tmp 1344 6095.tmp 2404 617F.tmp 2792 6298.tmp 1056 6392.tmp 888 646D.tmp 2200 6567.tmp 2952 6661.tmp 1700 673C.tmp 5004 6826.tmp 4576 6901.tmp 1788 697E.tmp 6120 6A1A.tmp 4600 6AE5.tmp 6068 6B91.tmp 1896 6C0E.tmp 4468 6CE9.tmp 4540 6D76.tmp 3104 6E02.tmp 1288 6E70.tmp 2388 6F3B.tmp 3888 7006.tmp 5624 70A2.tmp 3572 712F.tmp 2004 718C.tmp 5764 7209.tmp 2740 7286.tmp 4300 72E4.tmp 4648 7371.tmp 5304 73EE.tmp 924 746B.tmp 1920 74C9.tmp 616 7546.tmp 1536 75D2.tmp 2284 7640.tmp 4684 76CC.tmp 600 7749.tmp 2560 77C6.tmp 4404 7843.tmp 5672 78B1.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 154A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DECD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B085.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3778.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D22B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 546F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7640.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1222.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5787.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 781F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9404.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 321D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E272.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4305.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B826.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1336.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 551.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D199.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6298.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F35A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B414.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F7B.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4172 wrote to memory of 5020 4172 2026-08-22_0859cd59c6df1fda198b893c188516fa_elex_mafia_stealc_tofsee.exe 89 PID 5020 wrote to memory of 2416 5020 48B7.tmp 90 PID 2416 wrote to memory of 6128 2416 4954.tmp 91 PID 6128 wrote to memory of 4328 6128 49D1.tmp 92 PID 4328 wrote to memory of 3468 4328 4B67.tmp 93 PID 3468 wrote to memory of 4784 3468 4CAF.tmp 94 PID 4784 wrote to memory of 4376 4784 4D4B.tmp 95 PID 4376 wrote to memory of 4236 4376 4E55.tmp 96 PID 4236 wrote to memory of 1064 4236 4F5E.tmp 97 PID 1064 wrote to memory of 4252 1064 5058.tmp 98 PID 4252 wrote to memory of 360 4252 5162.tmp 99 PID 360 wrote to memory of 4196 360 524C.tmp 100 PID 4196 wrote to memory of 4880 4196 5366.tmp 101 PID 4880 wrote to memory of 3636 4880 546F.tmp 102 PID 3636 wrote to memory of 3532 3636 552B.tmp 103 PID 3532 wrote to memory of 2232 3532 5654.tmp 104 PID 2232 wrote to memory of 4964 2232 573E.tmp 105 PID 4964 wrote to memory of 2816 4964 5819.tmp 106 PID 2816 wrote to memory of 4980 2816 58E4.tmp 107 PID 4980 wrote to memory of 5204 4980 5A0D.tmp 108 PID 5204 wrote to memory of 1152 5204 5B26.tmp 109 PID 1152 wrote to memory of 796 1152 5BF1.tmp 110 PID 796 wrote to memory of 5000 796 5CCC.tmp 111 PID 5000 wrote to memory of 4800 5000 5D97.tmp 112 PID 4800 wrote to memory of 2632 4800 5E72.tmp 113 PID 2632 wrote to memory of 1344 2632 5F7B.tmp 114 PID 1344 wrote to memory of 2404 1344 6095.tmp 115 PID 2404 wrote to memory of 2792 2404 617F.tmp 116 PID 2792 wrote to memory of 1056 2792 6298.tmp 117 PID 1056 wrote to memory of 888 1056 6392.tmp 118 PID 888 wrote to memory of 2200 888 646D.tmp 119 PID 2200 wrote to memory of 2952 2200 6567.tmp 120 PID 2952 wrote to memory of 1700 2952 6661.tmp 121 PID 1700 wrote to memory of 5004 1700 673C.tmp 122 PID 5004 wrote to memory of 4576 5004 6826.tmp 123 PID 4576 wrote to memory of 1788 4576 6901.tmp 124 PID 1788 wrote to memory of 6120 1788 697E.tmp 125 PID 6120 wrote to memory of 4600 6120 6A1A.tmp 126 PID 4600 wrote to memory of 6068 4600 6AE5.tmp 127 PID 6068 wrote to memory of 1896 6068 6B91.tmp 128 PID 1896 wrote to memory of 4468 1896 6C0E.tmp 129 PID 4468 wrote to memory of 4540 4468 6CE9.tmp 130 PID 4540 wrote to memory of 3104 4540 6D76.tmp 131 PID 3104 wrote to memory of 1288 3104 6E02.tmp 132 PID 1288 wrote to memory of 2388 1288 6E70.tmp 133 PID 2388 wrote to memory of 3888 2388 6F3B.tmp 134 PID 3888 wrote to memory of 5624 3888 7006.tmp 135 PID 5624 wrote to memory of 3572 5624 70A2.tmp 136 PID 3572 wrote to memory of 2004 3572 712F.tmp 137 PID 2004 wrote to memory of 5764 2004 718C.tmp 138 PID 5764 wrote to memory of 2740 5764 7209.tmp 139 PID 2740 wrote to memory of 4300 2740 7286.tmp 140 PID 4300 wrote to memory of 4648 4300 72E4.tmp 141 PID 4648 wrote to memory of 5304 4648 7371.tmp 142 PID 5304 wrote to memory of 924 5304 73EE.tmp 143 PID 924 wrote to memory of 1920 924 746B.tmp 144 PID 1920 wrote to memory of 616 1920 74C9.tmp 145 PID 616 wrote to memory of 1536 616 7546.tmp 146 PID 1536 wrote to memory of 2284 1536 75D2.tmp 147 PID 2284 wrote to memory of 4684 2284 7640.tmp 148 PID 4684 wrote to memory of 600 4684 76CC.tmp 149 PID 600 wrote to memory of 2560 600 7749.tmp 150 PID 2560 wrote to memory of 4404 2560 77C6.tmp 151 PID 4404 wrote to memory of 5672 4404 7843.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_0859cd59c6df1fda198b893c188516fa_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_0859cd59c6df1fda198b893c188516fa_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\48B7.tmp"C:\Users\Admin\AppData\Local\Temp\48B7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\4954.tmp"C:\Users\Admin\AppData\Local\Temp\4954.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\49D1.tmp"C:\Users\Admin\AppData\Local\Temp\49D1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\4B67.tmp"C:\Users\Admin\AppData\Local\Temp\4B67.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\4D4B.tmp"C:\Users\Admin\AppData\Local\Temp\4D4B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\4E55.tmp"C:\Users\Admin\AppData\Local\Temp\4E55.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\4F5E.tmp"C:\Users\Admin\AppData\Local\Temp\4F5E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\5058.tmp"C:\Users\Admin\AppData\Local\Temp\5058.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\5162.tmp"C:\Users\Admin\AppData\Local\Temp\5162.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\524C.tmp"C:\Users\Admin\AppData\Local\Temp\524C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\5366.tmp"C:\Users\Admin\AppData\Local\Temp\5366.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\546F.tmp"C:\Users\Admin\AppData\Local\Temp\546F.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\552B.tmp"C:\Users\Admin\AppData\Local\Temp\552B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\5654.tmp"C:\Users\Admin\AppData\Local\Temp\5654.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\573E.tmp"C:\Users\Admin\AppData\Local\Temp\573E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\5819.tmp"C:\Users\Admin\AppData\Local\Temp\5819.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\58E4.tmp"C:\Users\Admin\AppData\Local\Temp\58E4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\5B26.tmp"C:\Users\Admin\AppData\Local\Temp\5B26.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Users\Admin\AppData\Local\Temp\5BF1.tmp"C:\Users\Admin\AppData\Local\Temp\5BF1.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\5CCC.tmp"C:\Users\Admin\AppData\Local\Temp\5CCC.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\5D97.tmp"C:\Users\Admin\AppData\Local\Temp\5D97.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\5E72.tmp"C:\Users\Admin\AppData\Local\Temp\5E72.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"C:\Users\Admin\AppData\Local\Temp\5F7B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\6095.tmp"C:\Users\Admin\AppData\Local\Temp\6095.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\617F.tmp"C:\Users\Admin\AppData\Local\Temp\617F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\6298.tmp"C:\Users\Admin\AppData\Local\Temp\6298.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\6392.tmp"C:\Users\Admin\AppData\Local\Temp\6392.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\646D.tmp"C:\Users\Admin\AppData\Local\Temp\646D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\6567.tmp"C:\Users\Admin\AppData\Local\Temp\6567.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\673C.tmp"C:\Users\Admin\AppData\Local\Temp\673C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\6826.tmp"C:\Users\Admin\AppData\Local\Temp\6826.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\6901.tmp"C:\Users\Admin\AppData\Local\Temp\6901.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\697E.tmp"C:\Users\Admin\AppData\Local\Temp\697E.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\6A1A.tmp"C:\Users\Admin\AppData\Local\Temp\6A1A.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\6AE5.tmp"C:\Users\Admin\AppData\Local\Temp\6AE5.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\6B91.tmp"C:\Users\Admin\AppData\Local\Temp\6B91.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\6CE9.tmp"C:\Users\Admin\AppData\Local\Temp\6CE9.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\6D76.tmp"C:\Users\Admin\AppData\Local\Temp\6D76.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\6E02.tmp"C:\Users\Admin\AppData\Local\Temp\6E02.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\6E70.tmp"C:\Users\Admin\AppData\Local\Temp\6E70.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"C:\Users\Admin\AppData\Local\Temp\6F3B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\7006.tmp"C:\Users\Admin\AppData\Local\Temp\7006.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\70A2.tmp"C:\Users\Admin\AppData\Local\Temp\70A2.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\712F.tmp"C:\Users\Admin\AppData\Local\Temp\712F.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\718C.tmp"C:\Users\Admin\AppData\Local\Temp\718C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\7209.tmp"C:\Users\Admin\AppData\Local\Temp\7209.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\7286.tmp"C:\Users\Admin\AppData\Local\Temp\7286.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\72E4.tmp"C:\Users\Admin\AppData\Local\Temp\72E4.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\7371.tmp"C:\Users\Admin\AppData\Local\Temp\7371.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\73EE.tmp"C:\Users\Admin\AppData\Local\Temp\73EE.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\746B.tmp"C:\Users\Admin\AppData\Local\Temp\746B.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\74C9.tmp"C:\Users\Admin\AppData\Local\Temp\74C9.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\7546.tmp"C:\Users\Admin\AppData\Local\Temp\7546.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\75D2.tmp"C:\Users\Admin\AppData\Local\Temp\75D2.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\7640.tmp"C:\Users\Admin\AppData\Local\Temp\7640.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\76CC.tmp"C:\Users\Admin\AppData\Local\Temp\76CC.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\7749.tmp"C:\Users\Admin\AppData\Local\Temp\7749.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Users\Admin\AppData\Local\Temp\77C6.tmp"C:\Users\Admin\AppData\Local\Temp\77C6.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\7843.tmp"C:\Users\Admin\AppData\Local\Temp\7843.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\78B1.tmp"C:\Users\Admin\AppData\Local\Temp\78B1.tmp"65⤵
- Executes dropped EXE
PID:5672 -
C:\Users\Admin\AppData\Local\Temp\792E.tmp"C:\Users\Admin\AppData\Local\Temp\792E.tmp"66⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\799B.tmp"C:\Users\Admin\AppData\Local\Temp\799B.tmp"67⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\7A18.tmp"C:\Users\Admin\AppData\Local\Temp\7A18.tmp"68⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\7AA5.tmp"C:\Users\Admin\AppData\Local\Temp\7AA5.tmp"69⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\7B12.tmp"C:\Users\Admin\AppData\Local\Temp\7B12.tmp"70⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"C:\Users\Admin\AppData\Local\Temp\7B7F.tmp"71⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"C:\Users\Admin\AppData\Local\Temp\7BFC.tmp"72⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"C:\Users\Admin\AppData\Local\Temp\7C6A.tmp"73⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\7CD7.tmp"C:\Users\Admin\AppData\Local\Temp\7CD7.tmp"74⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\7D64.tmp"C:\Users\Admin\AppData\Local\Temp\7D64.tmp"75⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\7DD1.tmp"C:\Users\Admin\AppData\Local\Temp\7DD1.tmp"76⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\7E5E.tmp"C:\Users\Admin\AppData\Local\Temp\7E5E.tmp"77⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\7ECB.tmp"C:\Users\Admin\AppData\Local\Temp\7ECB.tmp"78⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\7F48.tmp"C:\Users\Admin\AppData\Local\Temp\7F48.tmp"79⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\7FC5.tmp"C:\Users\Admin\AppData\Local\Temp\7FC5.tmp"80⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\8042.tmp"C:\Users\Admin\AppData\Local\Temp\8042.tmp"81⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\80AF.tmp"C:\Users\Admin\AppData\Local\Temp\80AF.tmp"82⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\811D.tmp"C:\Users\Admin\AppData\Local\Temp\811D.tmp"83⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\818A.tmp"C:\Users\Admin\AppData\Local\Temp\818A.tmp"84⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\81F8.tmp"C:\Users\Admin\AppData\Local\Temp\81F8.tmp"85⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\8265.tmp"C:\Users\Admin\AppData\Local\Temp\8265.tmp"86⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\82D2.tmp"C:\Users\Admin\AppData\Local\Temp\82D2.tmp"87⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\8340.tmp"C:\Users\Admin\AppData\Local\Temp\8340.tmp"88⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\83BD.tmp"C:\Users\Admin\AppData\Local\Temp\83BD.tmp"89⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\8449.tmp"C:\Users\Admin\AppData\Local\Temp\8449.tmp"90⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\84B7.tmp"C:\Users\Admin\AppData\Local\Temp\84B7.tmp"91⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\8543.tmp"C:\Users\Admin\AppData\Local\Temp\8543.tmp"92⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\85C0.tmp"C:\Users\Admin\AppData\Local\Temp\85C0.tmp"93⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\863D.tmp"C:\Users\Admin\AppData\Local\Temp\863D.tmp"94⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\86BA.tmp"C:\Users\Admin\AppData\Local\Temp\86BA.tmp"95⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\8728.tmp"C:\Users\Admin\AppData\Local\Temp\8728.tmp"96⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\8795.tmp"C:\Users\Admin\AppData\Local\Temp\8795.tmp"97⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\8812.tmp"C:\Users\Admin\AppData\Local\Temp\8812.tmp"98⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\887F.tmp"C:\Users\Admin\AppData\Local\Temp\887F.tmp"99⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\88ED.tmp"C:\Users\Admin\AppData\Local\Temp\88ED.tmp"100⤵PID:5236
-
C:\Users\Admin\AppData\Local\Temp\896A.tmp"C:\Users\Admin\AppData\Local\Temp\896A.tmp"101⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\89D7.tmp"C:\Users\Admin\AppData\Local\Temp\89D7.tmp"102⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\8A73.tmp"C:\Users\Admin\AppData\Local\Temp\8A73.tmp"103⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"104⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"105⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"C:\Users\Admin\AppData\Local\Temp\8BDB.tmp"106⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\8C58.tmp"C:\Users\Admin\AppData\Local\Temp\8C58.tmp"107⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"108⤵PID:5392
-
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"109⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"C:\Users\Admin\AppData\Local\Temp\8DA0.tmp"110⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"111⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\8E8A.tmp"C:\Users\Admin\AppData\Local\Temp\8E8A.tmp"112⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\8F07.tmp"C:\Users\Admin\AppData\Local\Temp\8F07.tmp"113⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\8F94.tmp"C:\Users\Admin\AppData\Local\Temp\8F94.tmp"114⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\9011.tmp"C:\Users\Admin\AppData\Local\Temp\9011.tmp"115⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\909E.tmp"C:\Users\Admin\AppData\Local\Temp\909E.tmp"116⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\911B.tmp"C:\Users\Admin\AppData\Local\Temp\911B.tmp"117⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\9188.tmp"C:\Users\Admin\AppData\Local\Temp\9188.tmp"118⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\9205.tmp"C:\Users\Admin\AppData\Local\Temp\9205.tmp"119⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\9272.tmp"C:\Users\Admin\AppData\Local\Temp\9272.tmp"120⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\92FF.tmp"C:\Users\Admin\AppData\Local\Temp\92FF.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\936C.tmp"C:\Users\Admin\AppData\Local\Temp\936C.tmp"122⤵PID:1260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-