Analysis
- max time kernel
113s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 00:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_5b3d9e2f5c3a43677f068cb39995383d_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_5b3d9e2f5c3a43677f068cb39995383d_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-29_5b3d9e2f5c3a43677f068cb39995383d_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260930-akyevswyhw
- SHA256 81f517f1d3149d8e342f0caa793987430f32a58d7df15a4e60e8bc0dcdaa0a25
- MD5 5b3d9e2f5c3a43677f068cb39995383d
- SHA1 584384902932217ac9983c349e0654436d71979d
- SHA512 99f610cd6f64fb1827b9355062e1a0223d209b382a9c1ebccb799b2c891f264d20677fd26121430628cbcc30a8bf68efd97a3a94a009005a978a05e3eaea609d
- SSDEEP 12288:HU5rCOTeiJebc6Zf5bczsVXZKd3tevy571z6SCv9NZ:HUQOJJe3fSzteq56v9N
- TLSH T127B4F025B585C033E99212354AE6EBB2593A7D325B26A4C73B90773E6FB12E0D774303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1212 4A3E.tmp 4976 4AEA.tmp 5404 4BA5.tmp 4388 4C42.tmp 2632 4CAF.tmp 3924 4D7A.tmp 2072 4FAD.tmp 4528 5097.tmp 752 5143.tmp 4480 51DF.tmp 5668 52AA.tmp 296 5385.tmp 1116 5460.tmp 704 552B.tmp 2228 55D7.tmp 4488 56D1.tmp 4884 575D.tmp 3844 5857.tmp 1880 5913.tmp 5436 59EE.tmp 4148 5AA9.tmp 1132 5B84.tmp 2828 5C30.tmp 4440 5CCC.tmp 3784 5D78.tmp 1820 5E53.tmp 2600 5F2D.tmp 3288 5FBA.tmp 4520 6075.tmp 5092 6131.tmp 4600 620C.tmp 2640 62C7.tmp 5256 6392.tmp 4848 640F.tmp 4936 647D.tmp 2184 6529.tmp 3780 65D4.tmp 3492 6690.tmp 3316 671D.tmp 2572 67C8.tmp 5708 6845.tmp 1680 68D2.tmp 1544 695F.tmp 2704 6A0B.tmp 1228 6A88.tmp 2100 6B05.tmp 6120 6B72.tmp 3224 6BDF.tmp 4328 6CAA.tmp 3804 6D56.tmp 5412 6DE3.tmp 1720 6E70.tmp 6020 6F1B.tmp 4668 6FA8.tmp 2660 7035.tmp 2800 70B2.tmp 4740 713E.tmp 972 71DB.tmp 2516 7277.tmp 4892 72F4.tmp 3856 7380.tmp 1512 73FD.tmp 5828 748A.tmp 2244 7517.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7277.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C922.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F217.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2339.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8927.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D95F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8994.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 552B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B05B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2491.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A520.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C356.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 104D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B807.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C082.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5332.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 575D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 280B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 591E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B315.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D320.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 713E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F023.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3990.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C601.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4420 wrote to memory of 1212 4420 2026-09-29_5b3d9e2f5c3a43677f068cb39995383d_elex_mafia_stealc_tofsee.exe 90 PID 1212 wrote to memory of 4976 1212 4A3E.tmp 91 PID 4976 wrote to memory of 5404 4976 4AEA.tmp 92 PID 5404 wrote to memory of 4388 5404 4BA5.tmp 93 PID 4388 wrote to memory of 2632 4388 4C42.tmp 94 PID 2632 wrote to memory of 3924 2632 4CAF.tmp 95 PID 3924 wrote to memory of 2072 3924 4D7A.tmp 96 PID 2072 wrote to memory of 4528 2072 4FAD.tmp 97 PID 4528 wrote to memory of 752 4528 5097.tmp 98 PID 752 wrote to memory of 4480 752 5143.tmp 99 PID 4480 wrote to memory of 5668 4480 51DF.tmp 100 PID 5668 wrote to memory of 296 5668 52AA.tmp 101 PID 296 wrote to memory of 1116 296 5385.tmp 102 PID 1116 wrote to memory of 704 1116 5460.tmp 103 PID 704 wrote to memory of 2228 704 552B.tmp 104 PID 2228 wrote to memory of 4488 2228 55D7.tmp 105 PID 4488 wrote to memory of 4884 4488 56D1.tmp 106 PID 4884 wrote to memory of 3844 4884 575D.tmp 107 PID 3844 wrote to memory of 1880 3844 5857.tmp 108 PID 1880 wrote to memory of 5436 1880 5913.tmp 109 PID 5436 wrote to memory of 4148 5436 59EE.tmp 110 PID 4148 wrote to memory of 1132 4148 5AA9.tmp 111 PID 1132 wrote to memory of 2828 1132 5B84.tmp 112 PID 2828 wrote to memory of 4440 2828 5C30.tmp 113 PID 4440 wrote to memory of 3784 4440 5CCC.tmp 114 PID 3784 wrote to memory of 1820 3784 5D78.tmp 115 PID 1820 wrote to memory of 2600 1820 5E53.tmp 116 PID 2600 wrote to memory of 3288 2600 5F2D.tmp 117 PID 3288 wrote to memory of 4520 3288 5FBA.tmp 118 PID 4520 wrote to memory of 5092 4520 6075.tmp 119 PID 5092 wrote to memory of 4600 5092 6131.tmp 120 PID 4600 wrote to memory of 2640 4600 620C.tmp 121 PID 2640 wrote to memory of 5256 2640 62C7.tmp 122 PID 5256 wrote to memory of 4848 5256 6392.tmp 123 PID 4848 wrote to memory of 4936 4848 640F.tmp 124 PID 4936 wrote to memory of 2184 4936 647D.tmp 125 PID 2184 wrote to memory of 3780 2184 6529.tmp 126 PID 3780 wrote to memory of 3492 3780 65D4.tmp 127 PID 3492 wrote to memory of 3316 3492 6690.tmp 128 PID 3316 wrote to memory of 2572 3316 671D.tmp 129 PID 2572 wrote to memory of 5708 2572 67C8.tmp 130 PID 5708 wrote to memory of 1680 5708 6845.tmp 131 PID 1680 wrote to memory of 1544 1680 68D2.tmp 132 PID 1544 wrote to memory of 2704 1544 695F.tmp 133 PID 2704 wrote to memory of 1228 2704 6A0B.tmp 134 PID 1228 wrote to memory of 2100 1228 6A88.tmp 135 PID 2100 wrote to memory of 6120 2100 6B05.tmp 136 PID 6120 wrote to memory of 3224 6120 6B72.tmp 137 PID 3224 wrote to memory of 4328 3224 6BDF.tmp 138 PID 4328 wrote to memory of 3804 4328 6CAA.tmp 139 PID 3804 wrote to memory of 5412 3804 6D56.tmp 140 PID 5412 wrote to memory of 1720 5412 6DE3.tmp 141 PID 1720 wrote to memory of 6020 1720 6E70.tmp 142 PID 6020 wrote to memory of 4668 6020 6F1B.tmp 143 PID 4668 wrote to memory of 2660 4668 6FA8.tmp 144 PID 2660 wrote to memory of 2800 2660 7035.tmp 145 PID 2800 wrote to memory of 4740 2800 70B2.tmp 146 PID 4740 wrote to memory of 972 4740 713E.tmp 147 PID 972 wrote to memory of 2516 972 71DB.tmp 148 PID 2516 wrote to memory of 4892 2516 7277.tmp 149 PID 4892 wrote to memory of 3856 4892 72F4.tmp 150 PID 3856 wrote to memory of 1512 3856 7380.tmp 151 PID 1512 wrote to memory of 5828 1512 73FD.tmp 152 PID 5828 wrote to memory of 2244 5828 748A.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_5b3d9e2f5c3a43677f068cb39995383d_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_5b3d9e2f5c3a43677f068cb39995383d_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"C:\Users\Admin\AppData\Local\Temp\4A3E.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\4AEA.tmp"C:\Users\Admin\AppData\Local\Temp\4AEA.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\4BA5.tmp"C:\Users\Admin\AppData\Local\Temp\4BA5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\4C42.tmp"C:\Users\Admin\AppData\Local\Temp\4C42.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"C:\Users\Admin\AppData\Local\Temp\4CAF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\4D7A.tmp"C:\Users\Admin\AppData\Local\Temp\4D7A.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\4FAD.tmp"C:\Users\Admin\AppData\Local\Temp\4FAD.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\5097.tmp"C:\Users\Admin\AppData\Local\Temp\5097.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\5143.tmp"C:\Users\Admin\AppData\Local\Temp\5143.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\51DF.tmp"C:\Users\Admin\AppData\Local\Temp\51DF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\52AA.tmp"C:\Users\Admin\AppData\Local\Temp\52AA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\5385.tmp"C:\Users\Admin\AppData\Local\Temp\5385.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Users\Admin\AppData\Local\Temp\5460.tmp"C:\Users\Admin\AppData\Local\Temp\5460.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\552B.tmp"C:\Users\Admin\AppData\Local\Temp\552B.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\55D7.tmp"C:\Users\Admin\AppData\Local\Temp\55D7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\56D1.tmp"C:\Users\Admin\AppData\Local\Temp\56D1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\575D.tmp"C:\Users\Admin\AppData\Local\Temp\575D.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\5857.tmp"C:\Users\Admin\AppData\Local\Temp\5857.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\5913.tmp"C:\Users\Admin\AppData\Local\Temp\5913.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\59EE.tmp"C:\Users\Admin\AppData\Local\Temp\59EE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Users\Admin\AppData\Local\Temp\5AA9.tmp"C:\Users\Admin\AppData\Local\Temp\5AA9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\5B84.tmp"C:\Users\Admin\AppData\Local\Temp\5B84.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\5C30.tmp"C:\Users\Admin\AppData\Local\Temp\5C30.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\5CCC.tmp"C:\Users\Admin\AppData\Local\Temp\5CCC.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\5D78.tmp"C:\Users\Admin\AppData\Local\Temp\5D78.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\5E53.tmp"C:\Users\Admin\AppData\Local\Temp\5E53.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\5F2D.tmp"C:\Users\Admin\AppData\Local\Temp\5F2D.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\5FBA.tmp"C:\Users\Admin\AppData\Local\Temp\5FBA.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\6075.tmp"C:\Users\Admin\AppData\Local\Temp\6075.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\6131.tmp"C:\Users\Admin\AppData\Local\Temp\6131.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\620C.tmp"C:\Users\Admin\AppData\Local\Temp\620C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\62C7.tmp"C:\Users\Admin\AppData\Local\Temp\62C7.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\6392.tmp"C:\Users\Admin\AppData\Local\Temp\6392.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\640F.tmp"C:\Users\Admin\AppData\Local\Temp\640F.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\647D.tmp"C:\Users\Admin\AppData\Local\Temp\647D.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\6529.tmp"C:\Users\Admin\AppData\Local\Temp\6529.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\65D4.tmp"C:\Users\Admin\AppData\Local\Temp\65D4.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\6690.tmp"C:\Users\Admin\AppData\Local\Temp\6690.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\671D.tmp"C:\Users\Admin\AppData\Local\Temp\671D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\6845.tmp"C:\Users\Admin\AppData\Local\Temp\6845.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\68D2.tmp"C:\Users\Admin\AppData\Local\Temp\68D2.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\695F.tmp"C:\Users\Admin\AppData\Local\Temp\695F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\6A0B.tmp"C:\Users\Admin\AppData\Local\Temp\6A0B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\6A88.tmp"C:\Users\Admin\AppData\Local\Temp\6A88.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\6B05.tmp"C:\Users\Admin\AppData\Local\Temp\6B05.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\6B72.tmp"C:\Users\Admin\AppData\Local\Temp\6B72.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Users\Admin\AppData\Local\Temp\6BDF.tmp"C:\Users\Admin\AppData\Local\Temp\6BDF.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\6D56.tmp"C:\Users\Admin\AppData\Local\Temp\6D56.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\6DE3.tmp"C:\Users\Admin\AppData\Local\Temp\6DE3.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\6E70.tmp"C:\Users\Admin\AppData\Local\Temp\6E70.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\6F1B.tmp"C:\Users\Admin\AppData\Local\Temp\6F1B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\6FA8.tmp"C:\Users\Admin\AppData\Local\Temp\6FA8.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\7035.tmp"C:\Users\Admin\AppData\Local\Temp\7035.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\70B2.tmp"C:\Users\Admin\AppData\Local\Temp\70B2.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\713E.tmp"C:\Users\Admin\AppData\Local\Temp\713E.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\71DB.tmp"C:\Users\Admin\AppData\Local\Temp\71DB.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\7277.tmp"C:\Users\Admin\AppData\Local\Temp\7277.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\72F4.tmp"C:\Users\Admin\AppData\Local\Temp\72F4.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\7380.tmp"C:\Users\Admin\AppData\Local\Temp\7380.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\73FD.tmp"C:\Users\Admin\AppData\Local\Temp\73FD.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\748A.tmp"C:\Users\Admin\AppData\Local\Temp\748A.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\7517.tmp"C:\Users\Admin\AppData\Local\Temp\7517.tmp"65⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\75C3.tmp"C:\Users\Admin\AppData\Local\Temp\75C3.tmp"66⤵PID:5560
-
C:\Users\Admin\AppData\Local\Temp\7640.tmp"C:\Users\Admin\AppData\Local\Temp\7640.tmp"67⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\76BD.tmp"C:\Users\Admin\AppData\Local\Temp\76BD.tmp"68⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\773A.tmp"C:\Users\Admin\AppData\Local\Temp\773A.tmp"69⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\77A7.tmp"C:\Users\Admin\AppData\Local\Temp\77A7.tmp"70⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\7814.tmp"C:\Users\Admin\AppData\Local\Temp\7814.tmp"71⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\78A1.tmp"C:\Users\Admin\AppData\Local\Temp\78A1.tmp"72⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\793D.tmp"C:\Users\Admin\AppData\Local\Temp\793D.tmp"73⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\79BA.tmp"C:\Users\Admin\AppData\Local\Temp\79BA.tmp"74⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\7A47.tmp"C:\Users\Admin\AppData\Local\Temp\7A47.tmp"75⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\7AB4.tmp"C:\Users\Admin\AppData\Local\Temp\7AB4.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\7B41.tmp"C:\Users\Admin\AppData\Local\Temp\7B41.tmp"77⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\7BBE.tmp"C:\Users\Admin\AppData\Local\Temp\7BBE.tmp"78⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\7C4A.tmp"C:\Users\Admin\AppData\Local\Temp\7C4A.tmp"79⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\7CB8.tmp"C:\Users\Admin\AppData\Local\Temp\7CB8.tmp"80⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\7D35.tmp"C:\Users\Admin\AppData\Local\Temp\7D35.tmp"81⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"C:\Users\Admin\AppData\Local\Temp\7DB2.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"C:\Users\Admin\AppData\Local\Temp\7E2F.tmp"83⤵PID:260
-
C:\Users\Admin\AppData\Local\Temp\7ECB.tmp"C:\Users\Admin\AppData\Local\Temp\7ECB.tmp"84⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\7F77.tmp"C:\Users\Admin\AppData\Local\Temp\7F77.tmp"85⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\8023.tmp"C:\Users\Admin\AppData\Local\Temp\8023.tmp"86⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\80AF.tmp"C:\Users\Admin\AppData\Local\Temp\80AF.tmp"87⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\813C.tmp"C:\Users\Admin\AppData\Local\Temp\813C.tmp"88⤵PID:5500
-
C:\Users\Admin\AppData\Local\Temp\81C9.tmp"C:\Users\Admin\AppData\Local\Temp\81C9.tmp"89⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\8275.tmp"C:\Users\Admin\AppData\Local\Temp\8275.tmp"90⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\82F2.tmp"C:\Users\Admin\AppData\Local\Temp\82F2.tmp"91⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\836F.tmp"C:\Users\Admin\AppData\Local\Temp\836F.tmp"92⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\83EC.tmp"C:\Users\Admin\AppData\Local\Temp\83EC.tmp"93⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\8459.tmp"C:\Users\Admin\AppData\Local\Temp\8459.tmp"94⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\84E6.tmp"C:\Users\Admin\AppData\Local\Temp\84E6.tmp"95⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\8582.tmp"C:\Users\Admin\AppData\Local\Temp\8582.tmp"96⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\85FF.tmp"C:\Users\Admin\AppData\Local\Temp\85FF.tmp"97⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\866C.tmp"C:\Users\Admin\AppData\Local\Temp\866C.tmp"98⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\86F9.tmp"C:\Users\Admin\AppData\Local\Temp\86F9.tmp"99⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\8785.tmp"C:\Users\Admin\AppData\Local\Temp\8785.tmp"100⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\8812.tmp"C:\Users\Admin\AppData\Local\Temp\8812.tmp"101⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\888F.tmp"C:\Users\Admin\AppData\Local\Temp\888F.tmp"102⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\88FC.tmp"C:\Users\Admin\AppData\Local\Temp\88FC.tmp"103⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\8999.tmp"C:\Users\Admin\AppData\Local\Temp\8999.tmp"104⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\8A16.tmp"C:\Users\Admin\AppData\Local\Temp\8A16.tmp"105⤵PID:5508
-
C:\Users\Admin\AppData\Local\Temp\8A73.tmp"C:\Users\Admin\AppData\Local\Temp\8A73.tmp"106⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"C:\Users\Admin\AppData\Local\Temp\8AF0.tmp"107⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"108⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\8BEA.tmp"C:\Users\Admin\AppData\Local\Temp\8BEA.tmp"109⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:808 -
C:\Users\Admin\AppData\Local\Temp\8D13.tmp"C:\Users\Admin\AppData\Local\Temp\8D13.tmp"111⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\8D81.tmp"C:\Users\Admin\AppData\Local\Temp\8D81.tmp"112⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"113⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"C:\Users\Admin\AppData\Local\Temp\8E7B.tmp"114⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\8F17.tmp"C:\Users\Admin\AppData\Local\Temp\8F17.tmp"115⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\8F94.tmp"C:\Users\Admin\AppData\Local\Temp\8F94.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\9011.tmp"C:\Users\Admin\AppData\Local\Temp\9011.tmp"117⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\908E.tmp"C:\Users\Admin\AppData\Local\Temp\908E.tmp"118⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\90FB.tmp"C:\Users\Admin\AppData\Local\Temp\90FB.tmp"119⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\9169.tmp"C:\Users\Admin\AppData\Local\Temp\9169.tmp"120⤵PID:6028
-
C:\Users\Admin\AppData\Local\Temp\91E6.tmp"C:\Users\Admin\AppData\Local\Temp\91E6.tmp"121⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\9263.tmp"C:\Users\Admin\AppData\Local\Temp\9263.tmp"122⤵PID:2272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-