Analysis
- max time kernel
128s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-22_9cf543daccade3fcd034b3243fe94f36_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_9cf543daccade3fcd034b3243fe94f36_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-22_9cf543daccade3fcd034b3243fe94f36_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260823-ejskfadr6x
- SHA256 5f279e670739cb79053abbd19707b92fcca8150668104c95fd6cf581bc7c0584
- MD5 9cf543daccade3fcd034b3243fe94f36
- SHA1 2d9827ea927947c627b2f2f0b66ab0b7118bf822
- SHA512 030fcbb48eba5b57186840aa5dde644ac8a0e01f61cd824e13b7102135bed37ac2b26547d432877f0aae2997fd023383566b30d9a813b0d00ea8fbe7177ec686
- SSDEEP 6144:oorf3lPvovsgZnqG2C7mOTeiL/DLOQ5ZLQAqapI2cpfGx6W+Gj2jEV5HbvSIVs3K:NU5rCOTeijlrt+fGx6iyEnJoy+TZwlH
- TLSH T128B4F126B684C032E59212710BE6EBB26D3ABC34472694C33B94677E2F716E1D73530B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2192 470D.tmp 1804 47D8.tmp 4152 4864.tmp 4024 48D2.tmp 4020 496E.tmp 4708 49EB.tmp 5820 4A78.tmp 4928 4B04.tmp 4616 4B81.tmp 4236 4C0E.tmp 4680 4CAA.tmp 3920 4D66.tmp 3096 4E60.tmp 2880 4F98.tmp 1948 5015.tmp 1660 50E0.tmp 5992 519C.tmp 4824 5209.tmp 3180 52B5.tmp 4668 5371.tmp 4464 543C.tmp 3272 54F7.tmp 800 5584.tmp 628 5610.tmp 2392 56BC.tmp 5540 5778.tmp 2536 57E5.tmp 5780 5891.tmp 2460 593D.tmp 4324 59CA.tmp 2268 5A75.tmp 4196 5B41.tmp 3420 5BDD.tmp 2240 5C4A.tmp 3736 5CB8.tmp 4892 5D35.tmp 2716 5DA2.tmp 5900 5E0F.tmp 3068 5E7D.tmp 1340 5EEA.tmp 2780 5F77.tmp 3168 5FD4.tmp 5776 6042.tmp 1216 60CE.tmp 4852 614B.tmp 3112 61B9.tmp 2336 6226.tmp 2708 62A3.tmp 1968 6311.tmp 4184 639D.tmp 5432 640B.tmp 5084 6478.tmp 5880 64E5.tmp 2316 6562.tmp 3900 65DF.tmp 4556 664D.tmp 1456 66BA.tmp 4136 6747.tmp 1300 67B4.tmp 1388 6821.tmp 6068 689E.tmp 4984 692B.tmp 5372 69B8.tmp 2608 6A35.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C72A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6821.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C773.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F113.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6619.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A71A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2012.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E197.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 775F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3466.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D85B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6435.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F47E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6042.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8742.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E08E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EABF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1588.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F31C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C797.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4812 wrote to memory of 2192 4812 2026-08-22_9cf543daccade3fcd034b3243fe94f36_elex_mafia_stealc_tofsee.exe 88 PID 2192 wrote to memory of 1804 2192 470D.tmp 89 PID 1804 wrote to memory of 4152 1804 47D8.tmp 90 PID 4152 wrote to memory of 4024 4152 4864.tmp 91 PID 4024 wrote to memory of 4020 4024 48D2.tmp 92 PID 4020 wrote to memory of 4708 4020 496E.tmp 93 PID 4708 wrote to memory of 5820 4708 49EB.tmp 94 PID 5820 wrote to memory of 4928 5820 4A78.tmp 95 PID 4928 wrote to memory of 4616 4928 4B04.tmp 96 PID 4616 wrote to memory of 4236 4616 4B81.tmp 97 PID 4236 wrote to memory of 4680 4236 4C0E.tmp 98 PID 4680 wrote to memory of 3920 4680 4CAA.tmp 99 PID 3920 wrote to memory of 3096 3920 4D66.tmp 100 PID 3096 wrote to memory of 2880 3096 4E60.tmp 101 PID 2880 wrote to memory of 1948 2880 4F98.tmp 102 PID 1948 wrote to memory of 1660 1948 5015.tmp 103 PID 1660 wrote to memory of 5992 1660 50E0.tmp 104 PID 5992 wrote to memory of 4824 5992 519C.tmp 105 PID 4824 wrote to memory of 3180 4824 5209.tmp 106 PID 3180 wrote to memory of 4668 3180 52B5.tmp 107 PID 4668 wrote to memory of 4464 4668 5371.tmp 108 PID 4464 wrote to memory of 3272 4464 543C.tmp 109 PID 3272 wrote to memory of 800 3272 54F7.tmp 110 PID 800 wrote to memory of 628 800 5584.tmp 111 PID 628 wrote to memory of 2392 628 5610.tmp 112 PID 2392 wrote to memory of 5540 2392 56BC.tmp 113 PID 5540 wrote to memory of 2536 5540 5778.tmp 114 PID 2536 wrote to memory of 5780 2536 57E5.tmp 115 PID 5780 wrote to memory of 2460 5780 5891.tmp 116 PID 2460 wrote to memory of 4324 2460 593D.tmp 117 PID 4324 wrote to memory of 2268 4324 59CA.tmp 118 PID 2268 wrote to memory of 4196 2268 5A75.tmp 119 PID 4196 wrote to memory of 3420 4196 5B41.tmp 120 PID 3420 wrote to memory of 2240 3420 5BDD.tmp 121 PID 2240 wrote to memory of 3736 2240 5C4A.tmp 122 PID 3736 wrote to memory of 4892 3736 5CB8.tmp 123 PID 4892 wrote to memory of 2716 4892 5D35.tmp 124 PID 2716 wrote to memory of 5900 2716 5DA2.tmp 125 PID 5900 wrote to memory of 3068 5900 5E0F.tmp 126 PID 3068 wrote to memory of 1340 3068 5E7D.tmp 127 PID 1340 wrote to memory of 2780 1340 5EEA.tmp 128 PID 2780 wrote to memory of 3168 2780 5F77.tmp 129 PID 3168 wrote to memory of 5776 3168 5FD4.tmp 130 PID 5776 wrote to memory of 1216 5776 6042.tmp 131 PID 1216 wrote to memory of 4852 1216 60CE.tmp 132 PID 4852 wrote to memory of 3112 4852 614B.tmp 133 PID 3112 wrote to memory of 2336 3112 61B9.tmp 134 PID 2336 wrote to memory of 2708 2336 6226.tmp 135 PID 2708 wrote to memory of 1968 2708 62A3.tmp 136 PID 1968 wrote to memory of 4184 1968 6311.tmp 137 PID 4184 wrote to memory of 5432 4184 639D.tmp 138 PID 5432 wrote to memory of 5084 5432 640B.tmp 139 PID 5084 wrote to memory of 5880 5084 6478.tmp 140 PID 5880 wrote to memory of 2316 5880 64E5.tmp 141 PID 2316 wrote to memory of 3900 2316 6562.tmp 142 PID 3900 wrote to memory of 4556 3900 65DF.tmp 143 PID 4556 wrote to memory of 1456 4556 664D.tmp 144 PID 1456 wrote to memory of 4136 1456 66BA.tmp 145 PID 4136 wrote to memory of 1300 4136 6747.tmp 146 PID 1300 wrote to memory of 1388 1300 67B4.tmp 147 PID 1388 wrote to memory of 6068 1388 6821.tmp 148 PID 6068 wrote to memory of 4984 6068 689E.tmp 149 PID 4984 wrote to memory of 5372 4984 692B.tmp 150 PID 5372 wrote to memory of 2608 5372 69B8.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_9cf543daccade3fcd034b3243fe94f36_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_9cf543daccade3fcd034b3243fe94f36_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\470D.tmp"C:\Users\Admin\AppData\Local\Temp\470D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\47D8.tmp"C:\Users\Admin\AppData\Local\Temp\47D8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\4864.tmp"C:\Users\Admin\AppData\Local\Temp\4864.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\48D2.tmp"C:\Users\Admin\AppData\Local\Temp\48D2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\496E.tmp"C:\Users\Admin\AppData\Local\Temp\496E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\49EB.tmp"C:\Users\Admin\AppData\Local\Temp\49EB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\4A78.tmp"C:\Users\Admin\AppData\Local\Temp\4A78.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\4B04.tmp"C:\Users\Admin\AppData\Local\Temp\4B04.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\4B81.tmp"C:\Users\Admin\AppData\Local\Temp\4B81.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\4CAA.tmp"C:\Users\Admin\AppData\Local\Temp\4CAA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\4D66.tmp"C:\Users\Admin\AppData\Local\Temp\4D66.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\4E60.tmp"C:\Users\Admin\AppData\Local\Temp\4E60.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\4F98.tmp"C:\Users\Admin\AppData\Local\Temp\4F98.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\5015.tmp"C:\Users\Admin\AppData\Local\Temp\5015.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\50E0.tmp"C:\Users\Admin\AppData\Local\Temp\50E0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\519C.tmp"C:\Users\Admin\AppData\Local\Temp\519C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\5209.tmp"C:\Users\Admin\AppData\Local\Temp\5209.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\52B5.tmp"C:\Users\Admin\AppData\Local\Temp\52B5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\5371.tmp"C:\Users\Admin\AppData\Local\Temp\5371.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\543C.tmp"C:\Users\Admin\AppData\Local\Temp\543C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\54F7.tmp"C:\Users\Admin\AppData\Local\Temp\54F7.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\5584.tmp"C:\Users\Admin\AppData\Local\Temp\5584.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\5610.tmp"C:\Users\Admin\AppData\Local\Temp\5610.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\56BC.tmp"C:\Users\Admin\AppData\Local\Temp\56BC.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\5778.tmp"C:\Users\Admin\AppData\Local\Temp\5778.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\57E5.tmp"C:\Users\Admin\AppData\Local\Temp\57E5.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\5891.tmp"C:\Users\Admin\AppData\Local\Temp\5891.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\593D.tmp"C:\Users\Admin\AppData\Local\Temp\593D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\59CA.tmp"C:\Users\Admin\AppData\Local\Temp\59CA.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\5A75.tmp"C:\Users\Admin\AppData\Local\Temp\5A75.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\5B41.tmp"C:\Users\Admin\AppData\Local\Temp\5B41.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\5BDD.tmp"C:\Users\Admin\AppData\Local\Temp\5BDD.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\5C4A.tmp"C:\Users\Admin\AppData\Local\Temp\5C4A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\5CB8.tmp"C:\Users\Admin\AppData\Local\Temp\5CB8.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\5D35.tmp"C:\Users\Admin\AppData\Local\Temp\5D35.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\5DA2.tmp"C:\Users\Admin\AppData\Local\Temp\5DA2.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\5E0F.tmp"C:\Users\Admin\AppData\Local\Temp\5E0F.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\5E7D.tmp"C:\Users\Admin\AppData\Local\Temp\5E7D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\5EEA.tmp"C:\Users\Admin\AppData\Local\Temp\5EEA.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\5F77.tmp"C:\Users\Admin\AppData\Local\Temp\5F77.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\5FD4.tmp"C:\Users\Admin\AppData\Local\Temp\5FD4.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\6042.tmp"C:\Users\Admin\AppData\Local\Temp\6042.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\60CE.tmp"C:\Users\Admin\AppData\Local\Temp\60CE.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\614B.tmp"C:\Users\Admin\AppData\Local\Temp\614B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\61B9.tmp"C:\Users\Admin\AppData\Local\Temp\61B9.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\6226.tmp"C:\Users\Admin\AppData\Local\Temp\6226.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\62A3.tmp"C:\Users\Admin\AppData\Local\Temp\62A3.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\6311.tmp"C:\Users\Admin\AppData\Local\Temp\6311.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\639D.tmp"C:\Users\Admin\AppData\Local\Temp\639D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\640B.tmp"C:\Users\Admin\AppData\Local\Temp\640B.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\6478.tmp"C:\Users\Admin\AppData\Local\Temp\6478.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\64E5.tmp"C:\Users\Admin\AppData\Local\Temp\64E5.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\6562.tmp"C:\Users\Admin\AppData\Local\Temp\6562.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\65DF.tmp"C:\Users\Admin\AppData\Local\Temp\65DF.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\664D.tmp"C:\Users\Admin\AppData\Local\Temp\664D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\66BA.tmp"C:\Users\Admin\AppData\Local\Temp\66BA.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\6747.tmp"C:\Users\Admin\AppData\Local\Temp\6747.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\67B4.tmp"C:\Users\Admin\AppData\Local\Temp\67B4.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\6821.tmp"C:\Users\Admin\AppData\Local\Temp\6821.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\689E.tmp"C:\Users\Admin\AppData\Local\Temp\689E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\692B.tmp"C:\Users\Admin\AppData\Local\Temp\692B.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\69B8.tmp"C:\Users\Admin\AppData\Local\Temp\69B8.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\6A35.tmp"C:\Users\Admin\AppData\Local\Temp\6A35.tmp"65⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\6AD1.tmp"C:\Users\Admin\AppData\Local\Temp\6AD1.tmp"66⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\6B3E.tmp"C:\Users\Admin\AppData\Local\Temp\6B3E.tmp"67⤵PID:5236
-
C:\Users\Admin\AppData\Local\Temp\6BAC.tmp"C:\Users\Admin\AppData\Local\Temp\6BAC.tmp"68⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\6C38.tmp"C:\Users\Admin\AppData\Local\Temp\6C38.tmp"69⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\6CA6.tmp"C:\Users\Admin\AppData\Local\Temp\6CA6.tmp"70⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\6D03.tmp"C:\Users\Admin\AppData\Local\Temp\6D03.tmp"71⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\6D80.tmp"C:\Users\Admin\AppData\Local\Temp\6D80.tmp"72⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\6DEE.tmp"C:\Users\Admin\AppData\Local\Temp\6DEE.tmp"73⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\6E5B.tmp"C:\Users\Admin\AppData\Local\Temp\6E5B.tmp"74⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\6ED8.tmp"C:\Users\Admin\AppData\Local\Temp\6ED8.tmp"75⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\6F46.tmp"C:\Users\Admin\AppData\Local\Temp\6F46.tmp"76⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\6FD2.tmp"C:\Users\Admin\AppData\Local\Temp\6FD2.tmp"77⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\705F.tmp"C:\Users\Admin\AppData\Local\Temp\705F.tmp"78⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\70CC.tmp"C:\Users\Admin\AppData\Local\Temp\70CC.tmp"79⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"80⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\71B7.tmp"C:\Users\Admin\AppData\Local\Temp\71B7.tmp"81⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\7214.tmp"C:\Users\Admin\AppData\Local\Temp\7214.tmp"82⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\7282.tmp"C:\Users\Admin\AppData\Local\Temp\7282.tmp"83⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\730E.tmp"C:\Users\Admin\AppData\Local\Temp\730E.tmp"84⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\738B.tmp"C:\Users\Admin\AppData\Local\Temp\738B.tmp"85⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\73F9.tmp"C:\Users\Admin\AppData\Local\Temp\73F9.tmp"86⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\7485.tmp"C:\Users\Admin\AppData\Local\Temp\7485.tmp"87⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\7502.tmp"C:\Users\Admin\AppData\Local\Temp\7502.tmp"88⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\7570.tmp"C:\Users\Admin\AppData\Local\Temp\7570.tmp"89⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\75DD.tmp"C:\Users\Admin\AppData\Local\Temp\75DD.tmp"90⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\765A.tmp"C:\Users\Admin\AppData\Local\Temp\765A.tmp"91⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\76C7.tmp"C:\Users\Admin\AppData\Local\Temp\76C7.tmp"92⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\7725.tmp"C:\Users\Admin\AppData\Local\Temp\7725.tmp"93⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\7783.tmp"C:\Users\Admin\AppData\Local\Temp\7783.tmp"94⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\7800.tmp"C:\Users\Admin\AppData\Local\Temp\7800.tmp"95⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\788D.tmp"C:\Users\Admin\AppData\Local\Temp\788D.tmp"96⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\78FA.tmp"C:\Users\Admin\AppData\Local\Temp\78FA.tmp"97⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\7967.tmp"C:\Users\Admin\AppData\Local\Temp\7967.tmp"98⤵PID:5420
-
C:\Users\Admin\AppData\Local\Temp\79D5.tmp"C:\Users\Admin\AppData\Local\Temp\79D5.tmp"99⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\7A52.tmp"C:\Users\Admin\AppData\Local\Temp\7A52.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\7ACF.tmp"C:\Users\Admin\AppData\Local\Temp\7ACF.tmp"101⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\7B3C.tmp"C:\Users\Admin\AppData\Local\Temp\7B3C.tmp"102⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\7BB9.tmp"C:\Users\Admin\AppData\Local\Temp\7BB9.tmp"103⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\7C36.tmp"C:\Users\Admin\AppData\Local\Temp\7C36.tmp"104⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\7C94.tmp"C:\Users\Admin\AppData\Local\Temp\7C94.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\7D20.tmp"C:\Users\Admin\AppData\Local\Temp\7D20.tmp"106⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\7D9D.tmp"C:\Users\Admin\AppData\Local\Temp\7D9D.tmp"107⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\7E2A.tmp"C:\Users\Admin\AppData\Local\Temp\7E2A.tmp"108⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\7E88.tmp"C:\Users\Admin\AppData\Local\Temp\7E88.tmp"109⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\7F14.tmp"C:\Users\Admin\AppData\Local\Temp\7F14.tmp"110⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\7F82.tmp"C:\Users\Admin\AppData\Local\Temp\7F82.tmp"111⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\7FEF.tmp"C:\Users\Admin\AppData\Local\Temp\7FEF.tmp"112⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\805D.tmp"C:\Users\Admin\AppData\Local\Temp\805D.tmp"113⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\80CA.tmp"C:\Users\Admin\AppData\Local\Temp\80CA.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\8137.tmp"C:\Users\Admin\AppData\Local\Temp\8137.tmp"115⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\81A5.tmp"C:\Users\Admin\AppData\Local\Temp\81A5.tmp"116⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\8222.tmp"C:\Users\Admin\AppData\Local\Temp\8222.tmp"117⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\827F.tmp"C:\Users\Admin\AppData\Local\Temp\827F.tmp"118⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\82DD.tmp"C:\Users\Admin\AppData\Local\Temp\82DD.tmp"119⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\835A.tmp"C:\Users\Admin\AppData\Local\Temp\835A.tmp"120⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\83C8.tmp"C:\Users\Admin\AppData\Local\Temp\83C8.tmp"121⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\8435.tmp"C:\Users\Admin\AppData\Local\Temp\8435.tmp"122⤵PID:2380
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-