Analysis
- max time kernel
127s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 11:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-14_d5a523966304ca0b9bfd0b9366d29737_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-14_d5a523966304ca0b9bfd0b9366d29737_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-14_d5a523966304ca0b9bfd0b9366d29737_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample261014-nchlbstwh1
- SHA256 2aae8f5a061995a00852e98e84169446af4451ccc2ce3399fbc28d77fe508f83
- MD5 d5a523966304ca0b9bfd0b9366d29737
- SHA1 918683f34b6786f2ed007ce48c1dff24b81587cf
- SHA512 df6108b575963d6f37939458de5d0b897a5d891e1776aa3b74df019d7daffb5398eb03bbcae74031aa4e0117340159538ef95b48d44133c3f94b996227998035
- SSDEEP 12288:9U5rCOTei6WE4FmGX66HHYZ5406VLIsSiY8QqZoXWjdqpby1grA70G+o:9UQOJ6aFmGX68YH4xMSQqqGh4yATXo
- TLSH T14AE40121BA85C036F99712314FE6EBB1197A7C355B22A4C33784A76E2FB42D1D278347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3656 F0DE.tmp 6140 F19A.tmp 3992 F2A3.tmp 3716 F3AD.tmp 4236 F488.tmp 2868 F572.tmp 4928 F62E.tmp 5708 F795.tmp 2028 F87F.tmp 5860 F95A.tmp 4216 FA16.tmp 1096 FAB2.tmp 1960 FB6D.tmp 3192 FC48.tmp 2832 FCE4.tmp 5084 FD81.tmp 2232 FE9A.tmp 5056 FF55.tmp 2776 6F.tmp 3224 178.tmp 5812 263.tmp 1500 36C.tmp 3384 418.tmp 6136 4D4.tmp 5500 59F.tmp 776 64B.tmp 5236 745.tmp 5416 85E.tmp 3552 958.tmp 2764 A52.tmp 4796 B0D.tmp 1444 C07.tmp 6128 CE2.tmp 5876 DAD.tmp 4184 E59.tmp 2904 EF5.tmp 4456 F92.tmp 3012 106C.tmp 2568 10DA.tmp 1560 1176.tmp 3156 1222.tmp 3604 12AE.tmp 3260 133B.tmp 4528 13D7.tmp 4920 1464.tmp 5572 1510.tmp 2588 15CB.tmp 5928 1648.tmp 1352 16E5.tmp 3000 1790.tmp 828 185C.tmp 5664 18E8.tmp 2276 1975.tmp 4256 1A6F.tmp 3608 1B1B.tmp 1860 1BC7.tmp 2564 1C92.tmp 2592 1D6C.tmp 4620 1E18.tmp 4816 1EA5.tmp 5076 1F51.tmp 2624 1FFD.tmp 4280 20C8.tmp 4540 21B2.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C928.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6330.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D53E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 992.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C84E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F95A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E149.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4864.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D841.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 127B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E205.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5253.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6994.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A52A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B48C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7173.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8307.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A65E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4824 wrote to memory of 3656 4824 2026-10-14_d5a523966304ca0b9bfd0b9366d29737_elex_mafia_stealc_tofsee.exe 88 PID 3656 wrote to memory of 6140 3656 F0DE.tmp 89 PID 6140 wrote to memory of 3992 6140 F19A.tmp 90 PID 3992 wrote to memory of 3716 3992 F2A3.tmp 91 PID 3716 wrote to memory of 4236 3716 F3AD.tmp 92 PID 4236 wrote to memory of 2868 4236 F488.tmp 93 PID 2868 wrote to memory of 4928 2868 F572.tmp 94 PID 4928 wrote to memory of 5708 4928 F62E.tmp 95 PID 5708 wrote to memory of 2028 5708 F795.tmp 96 PID 2028 wrote to memory of 5860 2028 F87F.tmp 97 PID 5860 wrote to memory of 4216 5860 F95A.tmp 98 PID 4216 wrote to memory of 1096 4216 FA16.tmp 99 PID 1096 wrote to memory of 1960 1096 FAB2.tmp 100 PID 1960 wrote to memory of 3192 1960 FB6D.tmp 101 PID 3192 wrote to memory of 2832 3192 FC48.tmp 102 PID 2832 wrote to memory of 5084 2832 FCE4.tmp 103 PID 5084 wrote to memory of 2232 5084 FD81.tmp 104 PID 2232 wrote to memory of 5056 2232 FE9A.tmp 105 PID 5056 wrote to memory of 2776 5056 FF55.tmp 106 PID 2776 wrote to memory of 3224 2776 6F.tmp 107 PID 3224 wrote to memory of 5812 3224 178.tmp 108 PID 5812 wrote to memory of 1500 5812 263.tmp 109 PID 1500 wrote to memory of 3384 1500 36C.tmp 110 PID 3384 wrote to memory of 6136 3384 418.tmp 111 PID 6136 wrote to memory of 5500 6136 4D4.tmp 112 PID 5500 wrote to memory of 776 5500 59F.tmp 113 PID 776 wrote to memory of 5236 776 64B.tmp 114 PID 5236 wrote to memory of 5416 5236 745.tmp 115 PID 5416 wrote to memory of 3552 5416 85E.tmp 116 PID 3552 wrote to memory of 2764 3552 958.tmp 117 PID 2764 wrote to memory of 4796 2764 A52.tmp 118 PID 4796 wrote to memory of 1444 4796 B0D.tmp 119 PID 1444 wrote to memory of 6128 1444 C07.tmp 120 PID 6128 wrote to memory of 5876 6128 CE2.tmp 121 PID 5876 wrote to memory of 4184 5876 DAD.tmp 122 PID 4184 wrote to memory of 2904 4184 E59.tmp 123 PID 2904 wrote to memory of 4456 2904 EF5.tmp 124 PID 4456 wrote to memory of 3012 4456 F92.tmp 125 PID 3012 wrote to memory of 2568 3012 106C.tmp 126 PID 2568 wrote to memory of 1560 2568 10DA.tmp 127 PID 1560 wrote to memory of 3156 1560 1176.tmp 128 PID 3156 wrote to memory of 3604 3156 1222.tmp 129 PID 3604 wrote to memory of 3260 3604 12AE.tmp 130 PID 3260 wrote to memory of 4528 3260 133B.tmp 131 PID 4528 wrote to memory of 4920 4528 13D7.tmp 132 PID 4920 wrote to memory of 5572 4920 1464.tmp 133 PID 5572 wrote to memory of 2588 5572 1510.tmp 134 PID 2588 wrote to memory of 5928 2588 15CB.tmp 135 PID 5928 wrote to memory of 1352 5928 1648.tmp 136 PID 1352 wrote to memory of 3000 1352 16E5.tmp 137 PID 3000 wrote to memory of 828 3000 1790.tmp 138 PID 828 wrote to memory of 5664 828 185C.tmp 139 PID 5664 wrote to memory of 2276 5664 18E8.tmp 140 PID 2276 wrote to memory of 4256 2276 1975.tmp 141 PID 4256 wrote to memory of 3608 4256 1A6F.tmp 142 PID 3608 wrote to memory of 1860 3608 1B1B.tmp 143 PID 1860 wrote to memory of 2564 1860 1BC7.tmp 144 PID 2564 wrote to memory of 2592 2564 1C92.tmp 145 PID 2592 wrote to memory of 4620 2592 1D6C.tmp 146 PID 4620 wrote to memory of 4816 4620 1E18.tmp 147 PID 4816 wrote to memory of 5076 4816 1EA5.tmp 148 PID 5076 wrote to memory of 2624 5076 1F51.tmp 149 PID 2624 wrote to memory of 4280 2624 1FFD.tmp 150 PID 4280 wrote to memory of 4540 4280 20C8.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-14_d5a523966304ca0b9bfd0b9366d29737_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-14_d5a523966304ca0b9bfd0b9366d29737_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\F0DE.tmp"C:\Users\Admin\AppData\Local\Temp\F0DE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\F19A.tmp"C:\Users\Admin\AppData\Local\Temp\F19A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\F2A3.tmp"C:\Users\Admin\AppData\Local\Temp\F2A3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\F3AD.tmp"C:\Users\Admin\AppData\Local\Temp\F3AD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\F488.tmp"C:\Users\Admin\AppData\Local\Temp\F488.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\F572.tmp"C:\Users\Admin\AppData\Local\Temp\F572.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\F62E.tmp"C:\Users\Admin\AppData\Local\Temp\F62E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\F795.tmp"C:\Users\Admin\AppData\Local\Temp\F795.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\F87F.tmp"C:\Users\Admin\AppData\Local\Temp\F87F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\F95A.tmp"C:\Users\Admin\AppData\Local\Temp\F95A.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\FA16.tmp"C:\Users\Admin\AppData\Local\Temp\FA16.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\FAB2.tmp"C:\Users\Admin\AppData\Local\Temp\FAB2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\FB6D.tmp"C:\Users\Admin\AppData\Local\Temp\FB6D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\FC48.tmp"C:\Users\Admin\AppData\Local\Temp\FC48.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\FCE4.tmp"C:\Users\Admin\AppData\Local\Temp\FCE4.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\FD81.tmp"C:\Users\Admin\AppData\Local\Temp\FD81.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\FF55.tmp"C:\Users\Admin\AppData\Local\Temp\FF55.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\6F.tmp"C:\Users\Admin\AppData\Local\Temp\6F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\178.tmp"C:\Users\Admin\AppData\Local\Temp\178.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\263.tmp"C:\Users\Admin\AppData\Local\Temp\263.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Local\Temp\36C.tmp"C:\Users\Admin\AppData\Local\Temp\36C.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\418.tmp"C:\Users\Admin\AppData\Local\Temp\418.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\4D4.tmp"C:\Users\Admin\AppData\Local\Temp\4D4.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\59F.tmp"C:\Users\Admin\AppData\Local\Temp\59F.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\64B.tmp"C:\Users\Admin\AppData\Local\Temp\64B.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\745.tmp"C:\Users\Admin\AppData\Local\Temp\745.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\85E.tmp"C:\Users\Admin\AppData\Local\Temp\85E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\958.tmp"C:\Users\Admin\AppData\Local\Temp\958.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\A52.tmp"C:\Users\Admin\AppData\Local\Temp\A52.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\B0D.tmp"C:\Users\Admin\AppData\Local\Temp\B0D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\C07.tmp"C:\Users\Admin\AppData\Local\Temp\C07.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\CE2.tmp"C:\Users\Admin\AppData\Local\Temp\CE2.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\DAD.tmp"C:\Users\Admin\AppData\Local\Temp\DAD.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\E59.tmp"C:\Users\Admin\AppData\Local\Temp\E59.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\EF5.tmp"C:\Users\Admin\AppData\Local\Temp\EF5.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\F92.tmp"C:\Users\Admin\AppData\Local\Temp\F92.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\106C.tmp"C:\Users\Admin\AppData\Local\Temp\106C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\10DA.tmp"C:\Users\Admin\AppData\Local\Temp\10DA.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\1176.tmp"C:\Users\Admin\AppData\Local\Temp\1176.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\1222.tmp"C:\Users\Admin\AppData\Local\Temp\1222.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\12AE.tmp"C:\Users\Admin\AppData\Local\Temp\12AE.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\133B.tmp"C:\Users\Admin\AppData\Local\Temp\133B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\13D7.tmp"C:\Users\Admin\AppData\Local\Temp\13D7.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\1464.tmp"C:\Users\Admin\AppData\Local\Temp\1464.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\1510.tmp"C:\Users\Admin\AppData\Local\Temp\1510.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\15CB.tmp"C:\Users\Admin\AppData\Local\Temp\15CB.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\1648.tmp"C:\Users\Admin\AppData\Local\Temp\1648.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\16E5.tmp"C:\Users\Admin\AppData\Local\Temp\16E5.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\1790.tmp"C:\Users\Admin\AppData\Local\Temp\1790.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\185C.tmp"C:\Users\Admin\AppData\Local\Temp\185C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\18E8.tmp"C:\Users\Admin\AppData\Local\Temp\18E8.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\1975.tmp"C:\Users\Admin\AppData\Local\Temp\1975.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\1A6F.tmp"C:\Users\Admin\AppData\Local\Temp\1A6F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\1B1B.tmp"C:\Users\Admin\AppData\Local\Temp\1B1B.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\1C92.tmp"C:\Users\Admin\AppData\Local\Temp\1C92.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\1E18.tmp"C:\Users\Admin\AppData\Local\Temp\1E18.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\1F51.tmp"C:\Users\Admin\AppData\Local\Temp\1F51.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\1FFD.tmp"C:\Users\Admin\AppData\Local\Temp\1FFD.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\20C8.tmp"C:\Users\Admin\AppData\Local\Temp\20C8.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\21B2.tmp"C:\Users\Admin\AppData\Local\Temp\21B2.tmp"65⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\226E.tmp"C:\Users\Admin\AppData\Local\Temp\226E.tmp"66⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\230A.tmp"C:\Users\Admin\AppData\Local\Temp\230A.tmp"67⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\23A6.tmp"C:\Users\Admin\AppData\Local\Temp\23A6.tmp"68⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"69⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"70⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\25D9.tmp"C:\Users\Admin\AppData\Local\Temp\25D9.tmp"71⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\277F.tmp"C:\Users\Admin\AppData\Local\Temp\277F.tmp"73⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\2869.tmp"C:\Users\Admin\AppData\Local\Temp\2869.tmp"74⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\2924.tmp"C:\Users\Admin\AppData\Local\Temp\2924.tmp"75⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\29FF.tmp"C:\Users\Admin\AppData\Local\Temp\29FF.tmp"76⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\2ADA.tmp"C:\Users\Admin\AppData\Local\Temp\2ADA.tmp"77⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\2B67.tmp"C:\Users\Admin\AppData\Local\Temp\2B67.tmp"78⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\2BE4.tmp"C:\Users\Admin\AppData\Local\Temp\2BE4.tmp"79⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\2C61.tmp"C:\Users\Admin\AppData\Local\Temp\2C61.tmp"80⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\2D0C.tmp"C:\Users\Admin\AppData\Local\Temp\2D0C.tmp"81⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\2D89.tmp"C:\Users\Admin\AppData\Local\Temp\2D89.tmp"82⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\2E06.tmp"C:\Users\Admin\AppData\Local\Temp\2E06.tmp"83⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\2EC2.tmp"C:\Users\Admin\AppData\Local\Temp\2EC2.tmp"84⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"85⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\3058.tmp"C:\Users\Admin\AppData\Local\Temp\3058.tmp"86⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\30E5.tmp"C:\Users\Admin\AppData\Local\Temp\30E5.tmp"87⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\3191.tmp"C:\Users\Admin\AppData\Local\Temp\3191.tmp"88⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\320E.tmp"C:\Users\Admin\AppData\Local\Temp\320E.tmp"89⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\328B.tmp"C:\Users\Admin\AppData\Local\Temp\328B.tmp"90⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\3308.tmp"C:\Users\Admin\AppData\Local\Temp\3308.tmp"91⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\33D3.tmp"C:\Users\Admin\AppData\Local\Temp\33D3.tmp"92⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\346F.tmp"C:\Users\Admin\AppData\Local\Temp\346F.tmp"93⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\34FC.tmp"C:\Users\Admin\AppData\Local\Temp\34FC.tmp"94⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\3598.tmp"C:\Users\Admin\AppData\Local\Temp\3598.tmp"95⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\3634.tmp"C:\Users\Admin\AppData\Local\Temp\3634.tmp"96⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\36B1.tmp"C:\Users\Admin\AppData\Local\Temp\36B1.tmp"97⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\376D.tmp"C:\Users\Admin\AppData\Local\Temp\376D.tmp"98⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\3838.tmp"C:\Users\Admin\AppData\Local\Temp\3838.tmp"99⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\38B5.tmp"C:\Users\Admin\AppData\Local\Temp\38B5.tmp"100⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\3941.tmp"C:\Users\Admin\AppData\Local\Temp\3941.tmp"101⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\39CE.tmp"C:\Users\Admin\AppData\Local\Temp\39CE.tmp"102⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\3A8A.tmp"C:\Users\Admin\AppData\Local\Temp\3A8A.tmp"103⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\3B07.tmp"C:\Users\Admin\AppData\Local\Temp\3B07.tmp"104⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\3B84.tmp"C:\Users\Admin\AppData\Local\Temp\3B84.tmp"105⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\3C20.tmp"C:\Users\Admin\AppData\Local\Temp\3C20.tmp"106⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\3CAC.tmp"C:\Users\Admin\AppData\Local\Temp\3CAC.tmp"107⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\3D39.tmp"C:\Users\Admin\AppData\Local\Temp\3D39.tmp"108⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\3DC6.tmp"C:\Users\Admin\AppData\Local\Temp\3DC6.tmp"109⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\3E52.tmp"C:\Users\Admin\AppData\Local\Temp\3E52.tmp"110⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\3ECF.tmp"C:\Users\Admin\AppData\Local\Temp\3ECF.tmp"111⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\3F5C.tmp"C:\Users\Admin\AppData\Local\Temp\3F5C.tmp"112⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\3FE9.tmp"C:\Users\Admin\AppData\Local\Temp\3FE9.tmp"113⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\4066.tmp"C:\Users\Admin\AppData\Local\Temp\4066.tmp"114⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\4102.tmp"C:\Users\Admin\AppData\Local\Temp\4102.tmp"115⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\41AE.tmp"C:\Users\Admin\AppData\Local\Temp\41AE.tmp"116⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\421B.tmp"C:\Users\Admin\AppData\Local\Temp\421B.tmp"117⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\42B7.tmp"C:\Users\Admin\AppData\Local\Temp\42B7.tmp"118⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\4334.tmp"C:\Users\Admin\AppData\Local\Temp\4334.tmp"119⤵PID:200
-
C:\Users\Admin\AppData\Local\Temp\441F.tmp"C:\Users\Admin\AppData\Local\Temp\441F.tmp"120⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\44CB.tmp"C:\Users\Admin\AppData\Local\Temp\44CB.tmp"121⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\4586.tmp"C:\Users\Admin\AppData\Local\Temp\4586.tmp"122⤵PID:1328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-