Analysis
- max time kernel
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 10:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-26_fef37304938a277f6a9f64170cda3d87_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_fef37304938a277f6a9f64170cda3d87_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260618-en
3 signatures
150 seconds
General
- Target 2026-06-26_fef37304938a277f6a9f64170cda3d87_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260629-mtzeqsds5p
- SHA256 dec9f5311d2e463a1b8a95a770131e19bdd90244507a56e5d85c40bc9b14cfb2
- MD5 fef37304938a277f6a9f64170cda3d87
- SHA1 bb7a8a8f376a14a5956b1d25b10b5241afd4972f
- SHA512 3ea89d52187a7678dcd1d69fe5303d39e949649e1b50387af083bde146f09a3442e4d18bca2e3a670740d7ca4be010dc2d9cf76723676e7c3fe82c6bd733a31c
- SSDEEP 12288:NU5rCOTeijcQnOT+goMalWWxBYFbTTZwlH:NUQOJjDnOT+PTlGZTTSlH
- TLSH T1DBB4F026B285C432D2D202310ADAEBB1693B7C315B2565C73B94767E2FB12E1E3B5347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5364 B503.tmp 5524 B5DE.tmp 4280 B699.tmp 1248 B774.tmp 2016 B87D.tmp 5776 B9D5.tmp 856 BA81.tmp 5808 BB4C.tmp 1116 BBF8.tmp 5404 BCD3.tmp 4832 BDAE.tmp 4748 BE4A.tmp 1232 BF05.tmp 5876 BFD0.tmp 3056 C06D.tmp 1784 C119.tmp 4756 C1D4.tmp 4312 C270.tmp 552 C34B.tmp 2700 C445.tmp 1832 C501.tmp 1568 C59D.tmp 1856 C687.tmp 1676 C723.tmp 5880 C83D.tmp 3564 C8E9.tmp 5884 C9A4.tmp 6032 CA50.tmp 268 CB4A.tmp 3816 CC05.tmp 1140 CCC1.tmp 3408 CDAB.tmp 2580 CE67.tmp 3340 CEF3.tmp 3292 CF80.tmp 6112 CFED.tmp 5528 D08A.tmp 696 D136.tmp 5352 D1B3.tmp 5724 D230.tmp 3328 D2BC.tmp 2328 D349.tmp 5844 D3E5.tmp 1796 D462.tmp 3400 D4CF.tmp 1268 D56C.tmp 5932 D5D9.tmp 2616 D666.tmp 996 D712.tmp 6024 D7BD.tmp 2896 D83A.tmp 5532 D8D7.tmp 5260 D973.tmp 3512 D9E0.tmp 1052 DA5D.tmp 4212 DADA.tmp 2200 DB67.tmp 2512 DBE4.tmp 5256 DC80.tmp 2688 DD2C.tmp 2304 DDC8.tmp 2572 DE45.tmp 3988 DED2.tmp 2452 DF4F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B699.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5579.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AADC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B934.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F255.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B04B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F728.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C76D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9580.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 982F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 624A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6505.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D462.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 243.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4603.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B774.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E10F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2404.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3673.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B72C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 718C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2040.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2711.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B670.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F69B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 597B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B140.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F534.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 228D.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3944 wrote to memory of 5364 3944 2026-06-26_fef37304938a277f6a9f64170cda3d87_elex_mafia_stealc_tofsee.exe 89 PID 5364 wrote to memory of 5524 5364 B503.tmp 90 PID 5524 wrote to memory of 4280 5524 B5DE.tmp 91 PID 4280 wrote to memory of 1248 4280 B699.tmp 92 PID 1248 wrote to memory of 2016 1248 B774.tmp 93 PID 2016 wrote to memory of 5776 2016 B87D.tmp 94 PID 5776 wrote to memory of 856 5776 B9D5.tmp 95 PID 856 wrote to memory of 5808 856 BA81.tmp 96 PID 5808 wrote to memory of 1116 5808 BB4C.tmp 97 PID 1116 wrote to memory of 5404 1116 BBF8.tmp 98 PID 5404 wrote to memory of 4832 5404 BCD3.tmp 99 PID 4832 wrote to memory of 4748 4832 BDAE.tmp 100 PID 4748 wrote to memory of 1232 4748 BE4A.tmp 101 PID 1232 wrote to memory of 5876 1232 BF05.tmp 102 PID 5876 wrote to memory of 3056 5876 BFD0.tmp 103 PID 3056 wrote to memory of 1784 3056 C06D.tmp 104 PID 1784 wrote to memory of 4756 1784 C119.tmp 105 PID 4756 wrote to memory of 4312 4756 C1D4.tmp 106 PID 4312 wrote to memory of 552 4312 C270.tmp 107 PID 552 wrote to memory of 2700 552 C34B.tmp 108 PID 2700 wrote to memory of 1832 2700 C445.tmp 109 PID 1832 wrote to memory of 1568 1832 C501.tmp 110 PID 1568 wrote to memory of 1856 1568 C59D.tmp 111 PID 1856 wrote to memory of 1676 1856 C687.tmp 112 PID 1676 wrote to memory of 5880 1676 C723.tmp 113 PID 5880 wrote to memory of 3564 5880 C83D.tmp 114 PID 3564 wrote to memory of 5884 3564 C8E9.tmp 115 PID 5884 wrote to memory of 6032 5884 C9A4.tmp 116 PID 6032 wrote to memory of 268 6032 CA50.tmp 117 PID 268 wrote to memory of 3816 268 CB4A.tmp 118 PID 3816 wrote to memory of 1140 3816 CC05.tmp 119 PID 1140 wrote to memory of 3408 1140 CCC1.tmp 120 PID 3408 wrote to memory of 2580 3408 CDAB.tmp 121 PID 2580 wrote to memory of 3340 2580 CE67.tmp 122 PID 3340 wrote to memory of 3292 3340 CEF3.tmp 123 PID 3292 wrote to memory of 6112 3292 CF80.tmp 124 PID 6112 wrote to memory of 5528 6112 CFED.tmp 125 PID 5528 wrote to memory of 696 5528 D08A.tmp 126 PID 696 wrote to memory of 5352 696 D136.tmp 127 PID 5352 wrote to memory of 5724 5352 D1B3.tmp 128 PID 5724 wrote to memory of 3328 5724 D230.tmp 129 PID 3328 wrote to memory of 2328 3328 D2BC.tmp 130 PID 2328 wrote to memory of 5844 2328 D349.tmp 131 PID 5844 wrote to memory of 1796 5844 D3E5.tmp 132 PID 1796 wrote to memory of 3400 1796 D462.tmp 133 PID 3400 wrote to memory of 1268 3400 D4CF.tmp 134 PID 1268 wrote to memory of 5932 1268 D56C.tmp 135 PID 5932 wrote to memory of 2616 5932 D5D9.tmp 136 PID 2616 wrote to memory of 996 2616 D666.tmp 137 PID 996 wrote to memory of 6024 996 D712.tmp 138 PID 6024 wrote to memory of 2896 6024 D7BD.tmp 139 PID 2896 wrote to memory of 5532 2896 D83A.tmp 140 PID 5532 wrote to memory of 5260 5532 D8D7.tmp 141 PID 5260 wrote to memory of 3512 5260 D973.tmp 142 PID 3512 wrote to memory of 1052 3512 D9E0.tmp 143 PID 1052 wrote to memory of 4212 1052 DA5D.tmp 144 PID 4212 wrote to memory of 2200 4212 DADA.tmp 145 PID 2200 wrote to memory of 2512 2200 DB67.tmp 146 PID 2512 wrote to memory of 5256 2512 DBE4.tmp 147 PID 5256 wrote to memory of 2688 5256 DC80.tmp 148 PID 2688 wrote to memory of 2304 2688 DD2C.tmp 149 PID 2304 wrote to memory of 2572 2304 DDC8.tmp 150 PID 2572 wrote to memory of 3988 2572 DE45.tmp 151 PID 3988 wrote to memory of 2452 3988 DED2.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_fef37304938a277f6a9f64170cda3d87_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_fef37304938a277f6a9f64170cda3d87_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\B503.tmp"C:\Users\Admin\AppData\Local\Temp\B503.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\B5DE.tmp"C:\Users\Admin\AppData\Local\Temp\B5DE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\B699.tmp"C:\Users\Admin\AppData\Local\Temp\B699.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\B774.tmp"C:\Users\Admin\AppData\Local\Temp\B774.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\B87D.tmp"C:\Users\Admin\AppData\Local\Temp\B87D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\B9D5.tmp"C:\Users\Admin\AppData\Local\Temp\B9D5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\BA81.tmp"C:\Users\Admin\AppData\Local\Temp\BA81.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\BB4C.tmp"C:\Users\Admin\AppData\Local\Temp\BB4C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\BBF8.tmp"C:\Users\Admin\AppData\Local\Temp\BBF8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\BCD3.tmp"C:\Users\Admin\AppData\Local\Temp\BCD3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\BDAE.tmp"C:\Users\Admin\AppData\Local\Temp\BDAE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\BE4A.tmp"C:\Users\Admin\AppData\Local\Temp\BE4A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\BF05.tmp"C:\Users\Admin\AppData\Local\Temp\BF05.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\BFD0.tmp"C:\Users\Admin\AppData\Local\Temp\BFD0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\C06D.tmp"C:\Users\Admin\AppData\Local\Temp\C06D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\C119.tmp"C:\Users\Admin\AppData\Local\Temp\C119.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\C1D4.tmp"C:\Users\Admin\AppData\Local\Temp\C1D4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\C270.tmp"C:\Users\Admin\AppData\Local\Temp\C270.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\C34B.tmp"C:\Users\Admin\AppData\Local\Temp\C34B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\C445.tmp"C:\Users\Admin\AppData\Local\Temp\C445.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\C501.tmp"C:\Users\Admin\AppData\Local\Temp\C501.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\C59D.tmp"C:\Users\Admin\AppData\Local\Temp\C59D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\C687.tmp"C:\Users\Admin\AppData\Local\Temp\C687.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\C723.tmp"C:\Users\Admin\AppData\Local\Temp\C723.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\C83D.tmp"C:\Users\Admin\AppData\Local\Temp\C83D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\C8E9.tmp"C:\Users\Admin\AppData\Local\Temp\C8E9.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\C9A4.tmp"C:\Users\Admin\AppData\Local\Temp\C9A4.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\CA50.tmp"C:\Users\Admin\AppData\Local\Temp\CA50.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Users\Admin\AppData\Local\Temp\CC05.tmp"C:\Users\Admin\AppData\Local\Temp\CC05.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\CE67.tmp"C:\Users\Admin\AppData\Local\Temp\CE67.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\CF80.tmp"C:\Users\Admin\AppData\Local\Temp\CF80.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\CFED.tmp"C:\Users\Admin\AppData\Local\Temp\CFED.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\D08A.tmp"C:\Users\Admin\AppData\Local\Temp\D08A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\D136.tmp"C:\Users\Admin\AppData\Local\Temp\D136.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\D1B3.tmp"C:\Users\Admin\AppData\Local\Temp\D1B3.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\D230.tmp"C:\Users\Admin\AppData\Local\Temp\D230.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\D349.tmp"C:\Users\Admin\AppData\Local\Temp\D349.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\D3E5.tmp"C:\Users\Admin\AppData\Local\Temp\D3E5.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\D462.tmp"C:\Users\Admin\AppData\Local\Temp\D462.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\D4CF.tmp"C:\Users\Admin\AppData\Local\Temp\D4CF.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\D56C.tmp"C:\Users\Admin\AppData\Local\Temp\D56C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\D5D9.tmp"C:\Users\Admin\AppData\Local\Temp\D5D9.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\D666.tmp"C:\Users\Admin\AppData\Local\Temp\D666.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\D712.tmp"C:\Users\Admin\AppData\Local\Temp\D712.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\D7BD.tmp"C:\Users\Admin\AppData\Local\Temp\D7BD.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\D83A.tmp"C:\Users\Admin\AppData\Local\Temp\D83A.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\D8D7.tmp"C:\Users\Admin\AppData\Local\Temp\D8D7.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\D973.tmp"C:\Users\Admin\AppData\Local\Temp\D973.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Users\Admin\AppData\Local\Temp\D9E0.tmp"C:\Users\Admin\AppData\Local\Temp\D9E0.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\DA5D.tmp"C:\Users\Admin\AppData\Local\Temp\DA5D.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\DADA.tmp"C:\Users\Admin\AppData\Local\Temp\DADA.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\DB67.tmp"C:\Users\Admin\AppData\Local\Temp\DB67.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\DBE4.tmp"C:\Users\Admin\AppData\Local\Temp\DBE4.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\DC80.tmp"C:\Users\Admin\AppData\Local\Temp\DC80.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\DDC8.tmp"C:\Users\Admin\AppData\Local\Temp\DDC8.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\DE45.tmp"C:\Users\Admin\AppData\Local\Temp\DE45.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\DED2.tmp"C:\Users\Admin\AppData\Local\Temp\DED2.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\DF4F.tmp"C:\Users\Admin\AppData\Local\Temp\DF4F.tmp"65⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\DFDC.tmp"C:\Users\Admin\AppData\Local\Temp\DFDC.tmp"66⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\E059.tmp"C:\Users\Admin\AppData\Local\Temp\E059.tmp"67⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\E104.tmp"C:\Users\Admin\AppData\Local\Temp\E104.tmp"68⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\E1C0.tmp"C:\Users\Admin\AppData\Local\Temp\E1C0.tmp"69⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\E23D.tmp"C:\Users\Admin\AppData\Local\Temp\E23D.tmp"70⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\E2AA.tmp"C:\Users\Admin\AppData\Local\Temp\E2AA.tmp"71⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\E337.tmp"C:\Users\Admin\AppData\Local\Temp\E337.tmp"72⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\E3A4.tmp"C:\Users\Admin\AppData\Local\Temp\E3A4.tmp"73⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\E431.tmp"C:\Users\Admin\AppData\Local\Temp\E431.tmp"74⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"75⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\E569.tmp"C:\Users\Admin\AppData\Local\Temp\E569.tmp"76⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"77⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\E663.tmp"C:\Users\Admin\AppData\Local\Temp\E663.tmp"78⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\E6F0.tmp"C:\Users\Admin\AppData\Local\Temp\E6F0.tmp"79⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\E76D.tmp"C:\Users\Admin\AppData\Local\Temp\E76D.tmp"80⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\E7FA.tmp"C:\Users\Admin\AppData\Local\Temp\E7FA.tmp"81⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\E886.tmp"C:\Users\Admin\AppData\Local\Temp\E886.tmp"82⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\E932.tmp"C:\Users\Admin\AppData\Local\Temp\E932.tmp"83⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\E9EE.tmp"C:\Users\Admin\AppData\Local\Temp\E9EE.tmp"84⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\EA7A.tmp"C:\Users\Admin\AppData\Local\Temp\EA7A.tmp"85⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\EB36.tmp"C:\Users\Admin\AppData\Local\Temp\EB36.tmp"86⤵PID:5280
-
C:\Users\Admin\AppData\Local\Temp\EBC2.tmp"C:\Users\Admin\AppData\Local\Temp\EBC2.tmp"87⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\EC4F.tmp"C:\Users\Admin\AppData\Local\Temp\EC4F.tmp"88⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\ED0B.tmp"C:\Users\Admin\AppData\Local\Temp\ED0B.tmp"89⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\ED88.tmp"C:\Users\Admin\AppData\Local\Temp\ED88.tmp"90⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\EE24.tmp"C:\Users\Admin\AppData\Local\Temp\EE24.tmp"91⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\EEB0.tmp"C:\Users\Admin\AppData\Local\Temp\EEB0.tmp"92⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\EF4D.tmp"C:\Users\Admin\AppData\Local\Temp\EF4D.tmp"93⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\EFD9.tmp"C:\Users\Admin\AppData\Local\Temp\EFD9.tmp"94⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\F066.tmp"C:\Users\Admin\AppData\Local\Temp\F066.tmp"95⤵PID:6028
-
C:\Users\Admin\AppData\Local\Temp\F0F3.tmp"C:\Users\Admin\AppData\Local\Temp\F0F3.tmp"96⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\F18F.tmp"C:\Users\Admin\AppData\Local\Temp\F18F.tmp"97⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\F21B.tmp"C:\Users\Admin\AppData\Local\Temp\F21B.tmp"98⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"99⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\F354.tmp"C:\Users\Admin\AppData\Local\Temp\F354.tmp"100⤵PID:5676
-
C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"101⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\F49C.tmp"C:\Users\Admin\AppData\Local\Temp\F49C.tmp"102⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\F538.tmp"C:\Users\Admin\AppData\Local\Temp\F538.tmp"103⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\F5D5.tmp"C:\Users\Admin\AppData\Local\Temp\F5D5.tmp"104⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\F661.tmp"C:\Users\Admin\AppData\Local\Temp\F661.tmp"105⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:572 -
C:\Users\Admin\AppData\Local\Temp\F7A9.tmp"C:\Users\Admin\AppData\Local\Temp\F7A9.tmp"107⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\F855.tmp"C:\Users\Admin\AppData\Local\Temp\F855.tmp"108⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\F8D2.tmp"C:\Users\Admin\AppData\Local\Temp\F8D2.tmp"109⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\F95F.tmp"C:\Users\Admin\AppData\Local\Temp\F95F.tmp"110⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\F9DC.tmp"C:\Users\Admin\AppData\Local\Temp\F9DC.tmp"111⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\FA59.tmp"C:\Users\Admin\AppData\Local\Temp\FA59.tmp"112⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\FAE5.tmp"C:\Users\Admin\AppData\Local\Temp\FAE5.tmp"113⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\FB82.tmp"C:\Users\Admin\AppData\Local\Temp\FB82.tmp"114⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\FC0E.tmp"C:\Users\Admin\AppData\Local\Temp\FC0E.tmp"115⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\FC7C.tmp"C:\Users\Admin\AppData\Local\Temp\FC7C.tmp"116⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\FCF9.tmp"C:\Users\Admin\AppData\Local\Temp\FCF9.tmp"117⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\FD76.tmp"C:\Users\Admin\AppData\Local\Temp\FD76.tmp"118⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\FE31.tmp"C:\Users\Admin\AppData\Local\Temp\FE31.tmp"119⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\FEBE.tmp"C:\Users\Admin\AppData\Local\Temp\FEBE.tmp"120⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"121⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\FFC7.tmp"C:\Users\Admin\AppData\Local\Temp\FFC7.tmp"122⤵PID:5652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-