Analysis
- max time kernel
150s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
27/05/2026, 07:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-27_04d318c0a92580fb7253b2596600e5f1_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-27_04d318c0a92580fb7253b2596600e5f1_elex_mafia_stealc_tofsee.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-05-27_04d318c0a92580fb7253b2596600e5f1_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260527-h2rmmsax4x
- SHA256 c9218469bd04d53013d3a4f4ced4ffeb482c6e15202b8358c48e525fd674e54b
- MD5 04d318c0a92580fb7253b2596600e5f1
- SHA1 9f4ea3531bb9c348784dfc85787721a373ca3e57
- SHA512 a6c2800a71f284546ea9c0425f63c8260f48d81118e73e275535ce5911c4e3cf1da6292e41cd93c59db34204482c85708f837049099c4a0e84de9baddc7b5811
- SSDEEP 12288:wU5rCOTeiD3mt6bpjOg3LuTERx4xjEYyBqDqNZ+3/v+I9hUG2VA:wUQOJD2t86TELbqmNGEA
- TLSH T13BE4D12177D88532E5FB037859B5F6514DBEBD226722D6CF2F8012AE0AB1BD08671723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5872 E53F.tmp 3908 E5FB.tmp 4860 E678.tmp 1112 E733.tmp 3044 E7FE.tmp 5084 E87B.tmp 4416 E927.tmp 5300 E9C4.tmp 4112 EA8F.tmp 744 EB2B.tmp 4432 EBA8.tmp 5548 EC63.tmp 2632 ECD1.tmp 2368 ED7D.tmp 4156 EE38.tmp 892 EEA6.tmp 3780 EF23.tmp 5868 EF90.tmp 5340 F00D.tmp 3668 F08A.tmp 5580 F117.tmp 5508 F1C2.tmp 3080 F29D.tmp 1716 F349.tmp 6020 F3E5.tmp 2976 F482.tmp 2400 F4FF.tmp 2600 F58B.tmp 2704 F5F9.tmp 2212 F695.tmp 2148 F712.tmp 2164 F7AE.tmp 3392 F84A.tmp 2376 F8A8.tmp 1428 F906.tmp 1676 F973.tmp 2112 F9C1.tmp 3688 FA0F.tmp 3364 FA6D.tmp 4388 FACB.tmp 1796 FB29.tmp 3572 FB96.tmp 5500 FBF4.tmp 2888 FC61.tmp 3108 FCBF.tmp 5660 FD2C.tmp 1268 FD9A.tmp 5796 FE07.tmp 5688 FE55.tmp 3480 FEA3.tmp 3308 FEF1.tmp 4012 FF40.tmp 5408 FF8E.tmp 4732 FFDC.tmp 1392 2A.tmp 2312 78.tmp 3212 B7.tmp 2768 114.tmp 1092 172.tmp 5792 1C0.tmp 1248 1FF.tmp 3188 24D.tmp 4896 28B.tmp 1200 2D9.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2215.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B929.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9016.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D164.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3687.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 161E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2287.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1292 wrote to memory of 5872 1292 2026-05-27_04d318c0a92580fb7253b2596600e5f1_elex_mafia_stealc_tofsee.exe 80 PID 5872 wrote to memory of 3908 5872 E53F.tmp 81 PID 3908 wrote to memory of 4860 3908 E5FB.tmp 82 PID 4860 wrote to memory of 1112 4860 E678.tmp 83 PID 1112 wrote to memory of 3044 1112 E733.tmp 84 PID 3044 wrote to memory of 5084 3044 E7FE.tmp 85 PID 5084 wrote to memory of 4416 5084 E87B.tmp 86 PID 4416 wrote to memory of 5300 4416 E927.tmp 87 PID 5300 wrote to memory of 4112 5300 E9C4.tmp 88 PID 4112 wrote to memory of 744 4112 EA8F.tmp 89 PID 744 wrote to memory of 4432 744 EB2B.tmp 90 PID 4432 wrote to memory of 5548 4432 EBA8.tmp 91 PID 5548 wrote to memory of 2632 5548 EC63.tmp 92 PID 2632 wrote to memory of 2368 2632 ECD1.tmp 93 PID 2368 wrote to memory of 4156 2368 ED7D.tmp 94 PID 4156 wrote to memory of 892 4156 EE38.tmp 95 PID 892 wrote to memory of 3780 892 EEA6.tmp 96 PID 3780 wrote to memory of 5868 3780 EF23.tmp 97 PID 5868 wrote to memory of 5340 5868 EF90.tmp 98 PID 5340 wrote to memory of 3668 5340 F00D.tmp 99 PID 3668 wrote to memory of 5580 3668 F08A.tmp 100 PID 5580 wrote to memory of 5508 5580 F117.tmp 101 PID 5508 wrote to memory of 3080 5508 F1C2.tmp 102 PID 3080 wrote to memory of 1716 3080 F29D.tmp 103 PID 1716 wrote to memory of 6020 1716 F349.tmp 104 PID 6020 wrote to memory of 2976 6020 F3E5.tmp 105 PID 2976 wrote to memory of 2400 2976 F482.tmp 106 PID 2400 wrote to memory of 2600 2400 F4FF.tmp 107 PID 2600 wrote to memory of 2704 2600 F58B.tmp 108 PID 2704 wrote to memory of 2212 2704 F5F9.tmp 109 PID 2212 wrote to memory of 2148 2212 F695.tmp 110 PID 2148 wrote to memory of 2164 2148 F712.tmp 111 PID 2164 wrote to memory of 3392 2164 F7AE.tmp 112 PID 3392 wrote to memory of 2376 3392 F84A.tmp 113 PID 2376 wrote to memory of 1428 2376 F8A8.tmp 114 PID 1428 wrote to memory of 1676 1428 F906.tmp 115 PID 1676 wrote to memory of 2112 1676 F973.tmp 116 PID 2112 wrote to memory of 3688 2112 F9C1.tmp 117 PID 3688 wrote to memory of 3364 3688 FA0F.tmp 118 PID 3364 wrote to memory of 4388 3364 FA6D.tmp 119 PID 4388 wrote to memory of 1796 4388 FACB.tmp 120 PID 1796 wrote to memory of 3572 1796 FB29.tmp 121 PID 3572 wrote to memory of 5500 3572 FB96.tmp 122 PID 5500 wrote to memory of 2888 5500 FBF4.tmp 123 PID 2888 wrote to memory of 3108 2888 FC61.tmp 124 PID 3108 wrote to memory of 5660 3108 FCBF.tmp 125 PID 5660 wrote to memory of 1268 5660 FD2C.tmp 126 PID 1268 wrote to memory of 5796 1268 FD9A.tmp 127 PID 5796 wrote to memory of 5688 5796 FE07.tmp 128 PID 5688 wrote to memory of 3480 5688 FE55.tmp 129 PID 3480 wrote to memory of 3308 3480 FEA3.tmp 130 PID 3308 wrote to memory of 4012 3308 FEF1.tmp 131 PID 4012 wrote to memory of 5408 4012 FF40.tmp 132 PID 5408 wrote to memory of 4732 5408 FF8E.tmp 133 PID 4732 wrote to memory of 1392 4732 FFDC.tmp 134 PID 1392 wrote to memory of 2312 1392 2A.tmp 135 PID 2312 wrote to memory of 3212 2312 78.tmp 136 PID 3212 wrote to memory of 2768 3212 B7.tmp 137 PID 2768 wrote to memory of 1092 2768 114.tmp 138 PID 1092 wrote to memory of 5792 1092 172.tmp 139 PID 5792 wrote to memory of 1248 5792 1C0.tmp 140 PID 1248 wrote to memory of 3188 1248 1FF.tmp 141 PID 3188 wrote to memory of 4896 3188 24D.tmp 142 PID 4896 wrote to memory of 1200 4896 28B.tmp 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-27_04d318c0a92580fb7253b2596600e5f1_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-27_04d318c0a92580fb7253b2596600e5f1_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"C:\Users\Admin\AppData\Local\Temp\ED7D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\EE38.tmp"C:\Users\Admin\AppData\Local\Temp\EE38.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\EF23.tmp"C:\Users\Admin\AppData\Local\Temp\EF23.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\F00D.tmp"C:\Users\Admin\AppData\Local\Temp\F00D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Users\Admin\AppData\Local\Temp\F08A.tmp"C:\Users\Admin\AppData\Local\Temp\F08A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\F117.tmp"C:\Users\Admin\AppData\Local\Temp\F117.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\F29D.tmp"C:\Users\Admin\AppData\Local\Temp\F29D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\F349.tmp"C:\Users\Admin\AppData\Local\Temp\F349.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\F695.tmp"C:\Users\Admin\AppData\Local\Temp\F695.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\F84A.tmp"C:\Users\Admin\AppData\Local\Temp\F84A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\F906.tmp"C:\Users\Admin\AppData\Local\Temp\F906.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\F973.tmp"C:\Users\Admin\AppData\Local\Temp\F973.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"C:\Users\Admin\AppData\Local\Temp\F9C1.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\FACB.tmp"C:\Users\Admin\AppData\Local\Temp\FACB.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\FB29.tmp"C:\Users\Admin\AppData\Local\Temp\FB29.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"C:\Users\Admin\AppData\Local\Temp\FBF4.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
C:\Users\Admin\AppData\Local\Temp\FC61.tmp"C:\Users\Admin\AppData\Local\Temp\FC61.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"C:\Users\Admin\AppData\Local\Temp\FD2C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"C:\Users\Admin\AppData\Local\Temp\FD9A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\FE07.tmp"C:\Users\Admin\AppData\Local\Temp\FE07.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\FE55.tmp"C:\Users\Admin\AppData\Local\Temp\FE55.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"C:\Users\Admin\AppData\Local\Temp\FEA3.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408 -
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\2A.tmp"C:\Users\Admin\AppData\Local\Temp\2A.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\78.tmp"C:\Users\Admin\AppData\Local\Temp\78.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\114.tmp"C:\Users\Admin\AppData\Local\Temp\114.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\172.tmp"C:\Users\Admin\AppData\Local\Temp\172.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\1C0.tmp"C:\Users\Admin\AppData\Local\Temp\1C0.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\24D.tmp"C:\Users\Admin\AppData\Local\Temp\24D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\2D9.tmp"C:\Users\Admin\AppData\Local\Temp\2D9.tmp"65⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\318.tmp"C:\Users\Admin\AppData\Local\Temp\318.tmp"66⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"67⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\3B4.tmp"C:\Users\Admin\AppData\Local\Temp\3B4.tmp"68⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"69⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"70⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\48F.tmp"C:\Users\Admin\AppData\Local\Temp\48F.tmp"71⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\4CD.tmp"C:\Users\Admin\AppData\Local\Temp\4CD.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\51C.tmp"C:\Users\Admin\AppData\Local\Temp\51C.tmp"73⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\56A.tmp"C:\Users\Admin\AppData\Local\Temp\56A.tmp"74⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\5B8.tmp"C:\Users\Admin\AppData\Local\Temp\5B8.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\606.tmp"C:\Users\Admin\AppData\Local\Temp\606.tmp"76⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\654.tmp"C:\Users\Admin\AppData\Local\Temp\654.tmp"77⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"79⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\74E.tmp"C:\Users\Admin\AppData\Local\Temp\74E.tmp"80⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\79C.tmp"C:\Users\Admin\AppData\Local\Temp\79C.tmp"81⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"82⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"83⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\887.tmp"C:\Users\Admin\AppData\Local\Temp\887.tmp"84⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\8D5.tmp"C:\Users\Admin\AppData\Local\Temp\8D5.tmp"85⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"86⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\961.tmp"C:\Users\Admin\AppData\Local\Temp\961.tmp"87⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\9A0.tmp"C:\Users\Admin\AppData\Local\Temp\9A0.tmp"88⤵PID:5192
-
C:\Users\Admin\AppData\Local\Temp\9EE.tmp"C:\Users\Admin\AppData\Local\Temp\9EE.tmp"89⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\A3C.tmp"C:\Users\Admin\AppData\Local\Temp\A3C.tmp"90⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\A8A.tmp"C:\Users\Admin\AppData\Local\Temp\A8A.tmp"91⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\AD8.tmp"C:\Users\Admin\AppData\Local\Temp\AD8.tmp"92⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\B26.tmp"C:\Users\Admin\AppData\Local\Temp\B26.tmp"93⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\B75.tmp"C:\Users\Admin\AppData\Local\Temp\B75.tmp"94⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\BC3.tmp"C:\Users\Admin\AppData\Local\Temp\BC3.tmp"95⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\C01.tmp"C:\Users\Admin\AppData\Local\Temp\C01.tmp"96⤵PID:5540
-
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"97⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"98⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"99⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\D49.tmp"C:\Users\Admin\AppData\Local\Temp\D49.tmp"100⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"101⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\DF5.tmp"C:\Users\Admin\AppData\Local\Temp\DF5.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:760 -
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"103⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"104⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\EE0.tmp"C:\Users\Admin\AppData\Local\Temp\EE0.tmp"105⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"106⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"107⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"108⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\1018.tmp"C:\Users\Admin\AppData\Local\Temp\1018.tmp"109⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\1057.tmp"C:\Users\Admin\AppData\Local\Temp\1057.tmp"110⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\1095.tmp"C:\Users\Admin\AppData\Local\Temp\1095.tmp"111⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"112⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\1122.tmp"C:\Users\Admin\AppData\Local\Temp\1122.tmp"113⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"114⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"115⤵PID:5964
-
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"116⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\123B.tmp"C:\Users\Admin\AppData\Local\Temp\123B.tmp"117⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\1289.tmp"C:\Users\Admin\AppData\Local\Temp\1289.tmp"118⤵PID:5236
-
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"119⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\1325.tmp"C:\Users\Admin\AppData\Local\Temp\1325.tmp"120⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"121⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\13C2.tmp"C:\Users\Admin\AppData\Local\Temp\13C2.tmp"122⤵PID:1380
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-