Analysis
- max time kernel
125s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/10/2026, 17:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_dc32abad8c280a2e1c4df100071c9d32_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_dc32abad8c280a2e1c4df100071c9d32_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-22_dc32abad8c280a2e1c4df100071c9d32_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample261023-vtmpyacy4x
- SHA256 911a56aac197827ee0bee2d85838ed26adcbf3adc4aa29e80b5154cdb4595ce6
- MD5 dc32abad8c280a2e1c4df100071c9d32
- SHA1 5858197d25db761d2dc685900a21c03da1e55d90
- SHA512 3236e8b35b33196b05d19142eca7633234cf467c908701dec66cb3c830a86dcf24db4ce85db19b9bb12bb7f9157d3e59a6f61178a0b6a4b428c27fe0a23a6c5e
- SSDEEP 12288:NU5rCOTeijAZCa88cOH/F6EmL/kTgj4XTZwlH4Hp:NUQOJjALLFckEEXTSlH4Hp
- TLSH T103B4F126B645C232E6C202714EDAEBB26A3B7C35572654C33B94623E2FB16E1D375307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1872 4F89.tmp 2908 5015.tmp 3952 50B1.tmp 1268 514E.tmp 2580 5209.tmp 5096 5277.tmp 120 52D4.tmp 5140 5380.tmp 1308 542C.tmp 4012 54B9.tmp 2348 5555.tmp 2760 55E2.tmp 4828 567E.tmp 4440 571A.tmp 1556 5843.tmp 3784 58FE.tmp 3336 59AA.tmp 5568 5A27.tmp 368 5AA4.tmp 5548 5B21.tmp 796 5BCD.tmp 4964 5C5A.tmp 3248 5CF6.tmp 5656 5D83.tmp 972 5E0F.tmp 6080 5EBB.tmp 2896 5F67.tmp 5348 5FF4.tmp 3760 6080.tmp 2752 60FD.tmp 1240 617A.tmp 2352 6255.tmp 3256 62E2.tmp 5904 635F.tmp 5148 63EB.tmp 4016 6459.tmp 2684 64C6.tmp 4744 6533.tmp 2976 65A1.tmp 4656 661E.tmp 3016 669B.tmp 5352 6727.tmp 4264 67A4.tmp 4252 6821.tmp 5740 688F.tmp 3244 690C.tmp 3424 6989.tmp 4100 69F6.tmp 2796 6A64.tmp 5792 6AD1.tmp 3204 6B5E.tmp 3428 6BDB.tmp 792 6C48.tmp 4120 6CD5.tmp 2020 6D52.tmp 4784 6DAF.tmp 2868 6E3C.tmp 1076 6EC9.tmp 3704 6F55.tmp 2972 6FB3.tmp 5404 7030.tmp 4712 70AD.tmp 2688 711A.tmp 5356 7188.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 635F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6821.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E09D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 468B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C31E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 669B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D68B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 650F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3223.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 241E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A847.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1842.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 535C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D415.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5909.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9603.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A76D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3005.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1768.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C11A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1341.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ECF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DADC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A98F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 173.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4152 wrote to memory of 1872 4152 2026-10-22_dc32abad8c280a2e1c4df100071c9d32_elex_mafia_stealc_tofsee.exe 88 PID 1872 wrote to memory of 2908 1872 4F89.tmp 89 PID 2908 wrote to memory of 3952 2908 5015.tmp 90 PID 3952 wrote to memory of 1268 3952 50B1.tmp 91 PID 1268 wrote to memory of 2580 1268 514E.tmp 92 PID 2580 wrote to memory of 5096 2580 5209.tmp 93 PID 5096 wrote to memory of 120 5096 5277.tmp 94 PID 120 wrote to memory of 5140 120 52D4.tmp 95 PID 5140 wrote to memory of 1308 5140 5380.tmp 96 PID 1308 wrote to memory of 4012 1308 542C.tmp 97 PID 4012 wrote to memory of 2348 4012 54B9.tmp 98 PID 2348 wrote to memory of 2760 2348 5555.tmp 99 PID 2760 wrote to memory of 4828 2760 55E2.tmp 100 PID 4828 wrote to memory of 4440 4828 567E.tmp 101 PID 4440 wrote to memory of 1556 4440 571A.tmp 102 PID 1556 wrote to memory of 3784 1556 5843.tmp 103 PID 3784 wrote to memory of 3336 3784 58FE.tmp 104 PID 3336 wrote to memory of 5568 3336 59AA.tmp 105 PID 5568 wrote to memory of 368 5568 5A27.tmp 106 PID 368 wrote to memory of 5548 368 5AA4.tmp 107 PID 5548 wrote to memory of 796 5548 5B21.tmp 108 PID 796 wrote to memory of 4964 796 5BCD.tmp 109 PID 4964 wrote to memory of 3248 4964 5C5A.tmp 110 PID 3248 wrote to memory of 5656 3248 5CF6.tmp 111 PID 5656 wrote to memory of 972 5656 5D83.tmp 112 PID 972 wrote to memory of 6080 972 5E0F.tmp 113 PID 6080 wrote to memory of 2896 6080 5EBB.tmp 114 PID 2896 wrote to memory of 5348 2896 5F67.tmp 115 PID 5348 wrote to memory of 3760 5348 5FF4.tmp 116 PID 3760 wrote to memory of 2752 3760 6080.tmp 117 PID 2752 wrote to memory of 1240 2752 60FD.tmp 118 PID 1240 wrote to memory of 2352 1240 617A.tmp 119 PID 2352 wrote to memory of 3256 2352 6255.tmp 120 PID 3256 wrote to memory of 5904 3256 62E2.tmp 121 PID 5904 wrote to memory of 5148 5904 635F.tmp 122 PID 5148 wrote to memory of 4016 5148 63EB.tmp 123 PID 4016 wrote to memory of 2684 4016 6459.tmp 124 PID 2684 wrote to memory of 4744 2684 64C6.tmp 125 PID 4744 wrote to memory of 2976 4744 6533.tmp 126 PID 2976 wrote to memory of 4656 2976 65A1.tmp 127 PID 4656 wrote to memory of 3016 4656 661E.tmp 128 PID 3016 wrote to memory of 5352 3016 669B.tmp 129 PID 5352 wrote to memory of 4264 5352 6727.tmp 130 PID 4264 wrote to memory of 4252 4264 67A4.tmp 131 PID 4252 wrote to memory of 5740 4252 6821.tmp 132 PID 5740 wrote to memory of 3244 5740 688F.tmp 133 PID 3244 wrote to memory of 3424 3244 690C.tmp 134 PID 3424 wrote to memory of 4100 3424 6989.tmp 135 PID 4100 wrote to memory of 2796 4100 69F6.tmp 136 PID 2796 wrote to memory of 5792 2796 6A64.tmp 137 PID 5792 wrote to memory of 3204 5792 6AD1.tmp 138 PID 3204 wrote to memory of 3428 3204 6B5E.tmp 139 PID 3428 wrote to memory of 792 3428 6BDB.tmp 140 PID 792 wrote to memory of 4120 792 6C48.tmp 141 PID 4120 wrote to memory of 2020 4120 6CD5.tmp 142 PID 2020 wrote to memory of 4784 2020 6D52.tmp 143 PID 4784 wrote to memory of 2868 4784 6DAF.tmp 144 PID 2868 wrote to memory of 1076 2868 6E3C.tmp 145 PID 1076 wrote to memory of 3704 1076 6EC9.tmp 146 PID 3704 wrote to memory of 2972 3704 6F55.tmp 147 PID 2972 wrote to memory of 5404 2972 6FB3.tmp 148 PID 5404 wrote to memory of 4712 5404 7030.tmp 149 PID 4712 wrote to memory of 2688 4712 70AD.tmp 150 PID 2688 wrote to memory of 5356 2688 711A.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_dc32abad8c280a2e1c4df100071c9d32_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_dc32abad8c280a2e1c4df100071c9d32_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\4F89.tmp"C:\Users\Admin\AppData\Local\Temp\4F89.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\5015.tmp"C:\Users\Admin\AppData\Local\Temp\5015.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\50B1.tmp"C:\Users\Admin\AppData\Local\Temp\50B1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\514E.tmp"C:\Users\Admin\AppData\Local\Temp\514E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\5209.tmp"C:\Users\Admin\AppData\Local\Temp\5209.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\5277.tmp"C:\Users\Admin\AppData\Local\Temp\5277.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\52D4.tmp"C:\Users\Admin\AppData\Local\Temp\52D4.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Users\Admin\AppData\Local\Temp\5380.tmp"C:\Users\Admin\AppData\Local\Temp\5380.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\542C.tmp"C:\Users\Admin\AppData\Local\Temp\542C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\54B9.tmp"C:\Users\Admin\AppData\Local\Temp\54B9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\5555.tmp"C:\Users\Admin\AppData\Local\Temp\5555.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\55E2.tmp"C:\Users\Admin\AppData\Local\Temp\55E2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\567E.tmp"C:\Users\Admin\AppData\Local\Temp\567E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\571A.tmp"C:\Users\Admin\AppData\Local\Temp\571A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\5843.tmp"C:\Users\Admin\AppData\Local\Temp\5843.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\58FE.tmp"C:\Users\Admin\AppData\Local\Temp\58FE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\59AA.tmp"C:\Users\Admin\AppData\Local\Temp\59AA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\5A27.tmp"C:\Users\Admin\AppData\Local\Temp\5A27.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5568 -
C:\Users\Admin\AppData\Local\Temp\5AA4.tmp"C:\Users\Admin\AppData\Local\Temp\5AA4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\5B21.tmp"C:\Users\Admin\AppData\Local\Temp\5B21.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\5BCD.tmp"C:\Users\Admin\AppData\Local\Temp\5BCD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\5C5A.tmp"C:\Users\Admin\AppData\Local\Temp\5C5A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\5CF6.tmp"C:\Users\Admin\AppData\Local\Temp\5CF6.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\5D83.tmp"C:\Users\Admin\AppData\Local\Temp\5D83.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\5E0F.tmp"C:\Users\Admin\AppData\Local\Temp\5E0F.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\5EBB.tmp"C:\Users\Admin\AppData\Local\Temp\5EBB.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\5F67.tmp"C:\Users\Admin\AppData\Local\Temp\5F67.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\5FF4.tmp"C:\Users\Admin\AppData\Local\Temp\5FF4.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Users\Admin\AppData\Local\Temp\6080.tmp"C:\Users\Admin\AppData\Local\Temp\6080.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\60FD.tmp"C:\Users\Admin\AppData\Local\Temp\60FD.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\617A.tmp"C:\Users\Admin\AppData\Local\Temp\617A.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\6255.tmp"C:\Users\Admin\AppData\Local\Temp\6255.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\62E2.tmp"C:\Users\Admin\AppData\Local\Temp\62E2.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\635F.tmp"C:\Users\Admin\AppData\Local\Temp\635F.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\63EB.tmp"C:\Users\Admin\AppData\Local\Temp\63EB.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\6459.tmp"C:\Users\Admin\AppData\Local\Temp\6459.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\64C6.tmp"C:\Users\Admin\AppData\Local\Temp\64C6.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\6533.tmp"C:\Users\Admin\AppData\Local\Temp\6533.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\65A1.tmp"C:\Users\Admin\AppData\Local\Temp\65A1.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\661E.tmp"C:\Users\Admin\AppData\Local\Temp\661E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\669B.tmp"C:\Users\Admin\AppData\Local\Temp\669B.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\6727.tmp"C:\Users\Admin\AppData\Local\Temp\6727.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\67A4.tmp"C:\Users\Admin\AppData\Local\Temp\67A4.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\6821.tmp"C:\Users\Admin\AppData\Local\Temp\6821.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\688F.tmp"C:\Users\Admin\AppData\Local\Temp\688F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\690C.tmp"C:\Users\Admin\AppData\Local\Temp\690C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\6989.tmp"C:\Users\Admin\AppData\Local\Temp\6989.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\69F6.tmp"C:\Users\Admin\AppData\Local\Temp\69F6.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\6A64.tmp"C:\Users\Admin\AppData\Local\Temp\6A64.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\6AD1.tmp"C:\Users\Admin\AppData\Local\Temp\6AD1.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\6B5E.tmp"C:\Users\Admin\AppData\Local\Temp\6B5E.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\6BDB.tmp"C:\Users\Admin\AppData\Local\Temp\6BDB.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\6C48.tmp"C:\Users\Admin\AppData\Local\Temp\6C48.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\6CD5.tmp"C:\Users\Admin\AppData\Local\Temp\6CD5.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\6D52.tmp"C:\Users\Admin\AppData\Local\Temp\6D52.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\6DAF.tmp"C:\Users\Admin\AppData\Local\Temp\6DAF.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\6E3C.tmp"C:\Users\Admin\AppData\Local\Temp\6E3C.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\6EC9.tmp"C:\Users\Admin\AppData\Local\Temp\6EC9.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\6F55.tmp"C:\Users\Admin\AppData\Local\Temp\6F55.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\6FB3.tmp"C:\Users\Admin\AppData\Local\Temp\6FB3.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\7030.tmp"C:\Users\Admin\AppData\Local\Temp\7030.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\70AD.tmp"C:\Users\Admin\AppData\Local\Temp\70AD.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\711A.tmp"C:\Users\Admin\AppData\Local\Temp\711A.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"65⤵
- Executes dropped EXE
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\71F5.tmp"C:\Users\Admin\AppData\Local\Temp\71F5.tmp"66⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\7272.tmp"C:\Users\Admin\AppData\Local\Temp\7272.tmp"67⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\72DF.tmp"C:\Users\Admin\AppData\Local\Temp\72DF.tmp"68⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\735C.tmp"C:\Users\Admin\AppData\Local\Temp\735C.tmp"69⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\73D9.tmp"C:\Users\Admin\AppData\Local\Temp\73D9.tmp"70⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\7466.tmp"C:\Users\Admin\AppData\Local\Temp\7466.tmp"71⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\74E3.tmp"C:\Users\Admin\AppData\Local\Temp\74E3.tmp"72⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\7560.tmp"C:\Users\Admin\AppData\Local\Temp\7560.tmp"73⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\75DD.tmp"C:\Users\Admin\AppData\Local\Temp\75DD.tmp"74⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\764A.tmp"C:\Users\Admin\AppData\Local\Temp\764A.tmp"75⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\76C7.tmp"C:\Users\Admin\AppData\Local\Temp\76C7.tmp"76⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\7735.tmp"C:\Users\Admin\AppData\Local\Temp\7735.tmp"77⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\77A2.tmp"C:\Users\Admin\AppData\Local\Temp\77A2.tmp"78⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\781F.tmp"C:\Users\Admin\AppData\Local\Temp\781F.tmp"79⤵PID:5820
-
C:\Users\Admin\AppData\Local\Temp\789C.tmp"C:\Users\Admin\AppData\Local\Temp\789C.tmp"80⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\790A.tmp"C:\Users\Admin\AppData\Local\Temp\790A.tmp"81⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\7987.tmp"C:\Users\Admin\AppData\Local\Temp\7987.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\79F4.tmp"C:\Users\Admin\AppData\Local\Temp\79F4.tmp"83⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\7A61.tmp"C:\Users\Admin\AppData\Local\Temp\7A61.tmp"84⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\7ACF.tmp"C:\Users\Admin\AppData\Local\Temp\7ACF.tmp"85⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\7B3C.tmp"C:\Users\Admin\AppData\Local\Temp\7B3C.tmp"86⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\7BB9.tmp"C:\Users\Admin\AppData\Local\Temp\7BB9.tmp"87⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\7C36.tmp"C:\Users\Admin\AppData\Local\Temp\7C36.tmp"88⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\7CB3.tmp"C:\Users\Admin\AppData\Local\Temp\7CB3.tmp"89⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\7D40.tmp"C:\Users\Admin\AppData\Local\Temp\7D40.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\7DDC.tmp"C:\Users\Admin\AppData\Local\Temp\7DDC.tmp"91⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\7E49.tmp"C:\Users\Admin\AppData\Local\Temp\7E49.tmp"92⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\7EB7.tmp"C:\Users\Admin\AppData\Local\Temp\7EB7.tmp"93⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\7F24.tmp"C:\Users\Admin\AppData\Local\Temp\7F24.tmp"94⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\7F91.tmp"C:\Users\Admin\AppData\Local\Temp\7F91.tmp"95⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\7FEF.tmp"C:\Users\Admin\AppData\Local\Temp\7FEF.tmp"96⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\805D.tmp"C:\Users\Admin\AppData\Local\Temp\805D.tmp"97⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\80DA.tmp"C:\Users\Admin\AppData\Local\Temp\80DA.tmp"98⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\8147.tmp"C:\Users\Admin\AppData\Local\Temp\8147.tmp"99⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\81B4.tmp"C:\Users\Admin\AppData\Local\Temp\81B4.tmp"100⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\8222.tmp"C:\Users\Admin\AppData\Local\Temp\8222.tmp"101⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\829F.tmp"C:\Users\Admin\AppData\Local\Temp\829F.tmp"102⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\82FC.tmp"C:\Users\Admin\AppData\Local\Temp\82FC.tmp"103⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\836A.tmp"C:\Users\Admin\AppData\Local\Temp\836A.tmp"104⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\83F6.tmp"C:\Users\Admin\AppData\Local\Temp\83F6.tmp"105⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\8464.tmp"C:\Users\Admin\AppData\Local\Temp\8464.tmp"106⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\84F0.tmp"C:\Users\Admin\AppData\Local\Temp\84F0.tmp"107⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\856D.tmp"C:\Users\Admin\AppData\Local\Temp\856D.tmp"108⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\85CB.tmp"C:\Users\Admin\AppData\Local\Temp\85CB.tmp"109⤵PID:5864
-
C:\Users\Admin\AppData\Local\Temp\8629.tmp"C:\Users\Admin\AppData\Local\Temp\8629.tmp"110⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\8696.tmp"C:\Users\Admin\AppData\Local\Temp\8696.tmp"111⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\8704.tmp"C:\Users\Admin\AppData\Local\Temp\8704.tmp"112⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\8771.tmp"C:\Users\Admin\AppData\Local\Temp\8771.tmp"113⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\87EE.tmp"C:\Users\Admin\AppData\Local\Temp\87EE.tmp"114⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\885B.tmp"C:\Users\Admin\AppData\Local\Temp\885B.tmp"115⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\88D8.tmp"C:\Users\Admin\AppData\Local\Temp\88D8.tmp"116⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\8946.tmp"C:\Users\Admin\AppData\Local\Temp\8946.tmp"117⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\89C3.tmp"C:\Users\Admin\AppData\Local\Temp\89C3.tmp"118⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\8A21.tmp"C:\Users\Admin\AppData\Local\Temp\8A21.tmp"119⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\8A8E.tmp"C:\Users\Admin\AppData\Local\Temp\8A8E.tmp"120⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\8AFB.tmp"C:\Users\Admin\AppData\Local\Temp\8AFB.tmp"121⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\8B88.tmp"C:\Users\Admin\AppData\Local\Temp\8B88.tmp"122⤵PID:2668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-