Analysis
- max time kernel
141s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 18:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-01_ef938a49919617091bb2f898f51fe400_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_ef938a49919617091bb2f898f51fe400_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 2026-07-01_ef938a49919617091bb2f898f51fe400_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260701-wp8bhsds4s
- SHA256 148096a05479c083b588c5295e64e23fd75cbd881fdba827b703f599e86f40a0
- MD5 ef938a49919617091bb2f898f51fe400
- SHA1 3d80b691a4fc2a41f11301bcae55818a65833f13
- SHA512 9fa054f2d4b8d125594b1f3520fb4a578d48e787fc9b64c430712132b0c5211317b8277e73ac6a14f39c9a51092d9ec822b18cb00f4484c70737e9a1334eb1e5
- SSDEEP 12288:NU5rCOTeij6bK9fHVBqDcr2nCnDuublAnTZwlH4Hp:NUQOJjMKtqDyQYDuMAnTSlH4Hp
- TLSH T15FB4F126B684C133E58202310ED6DBA26A3FBC75573A95C32794A27E2FB56E1C375343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2844 E47F.tmp 2604 E51B.tmp 5968 E5B8.tmp 1872 E663.tmp 3868 E6E0.tmp 5680 E74E.tmp 2140 E7CB.tmp 2332 E848.tmp 4948 E8B5.tmp 5924 E951.tmp 792 E9AF.tmp 4468 EA4B.tmp 4540 EAB9.tmp 4596 EB26.tmp 3396 EBB3.tmp 5864 EC4F.tmp 820 ECDC.tmp 616 ED78.tmp 5388 EDD6.tmp 3928 EE72.tmp 1580 EEEF.tmp 4340 EF8B.tmp 2524 F027.tmp 3768 F0C4.tmp 1752 F150.tmp 4080 F1BE.tmp 2296 F23B.tmp 2324 F298.tmp 6088 F335.tmp 256 F3D1.tmp 3772 F43E.tmp 4388 F4CB.tmp 5472 F548.tmp 3700 F596.tmp 3864 F5F4.tmp 5464 F661.tmp 2556 F6BF.tmp 5392 F71D.tmp 4928 F78A.tmp 3264 F7F7.tmp 548 F855.tmp 4084 F8B3.tmp 2964 F911.tmp 4820 F98E.tmp 2796 F9EB.tmp 3260 FA49.tmp 1124 FAA7.tmp 2340 FB05.tmp 1396 FB62.tmp 3352 FBD0.tmp 2436 FC2E.tmp 844 FCAB.tmp 2096 FCF9.tmp 4712 FD66.tmp 3472 FDC4.tmp 1176 FE22.tmp 1812 FE7F.tmp 2568 FEDD.tmp 4320 FF3B.tmp 4236 FF99.tmp 2360 FFF6.tmp 2944 54.tmp 2028 A2.tmp 5868 110.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E507.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4368.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1227.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 264B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5356.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 811D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 841A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3653.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6920.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5848.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 919.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 189F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 725.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E47F.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5292 wrote to memory of 2844 5292 2026-07-01_ef938a49919617091bb2f898f51fe400_elex_mafia_stealc_tofsee.exe 88 PID 2844 wrote to memory of 2604 2844 E47F.tmp 89 PID 2604 wrote to memory of 5968 2604 E51B.tmp 90 PID 5968 wrote to memory of 1872 5968 E5B8.tmp 91 PID 1872 wrote to memory of 3868 1872 E663.tmp 92 PID 3868 wrote to memory of 5680 3868 E6E0.tmp 93 PID 5680 wrote to memory of 2140 5680 E74E.tmp 94 PID 2140 wrote to memory of 2332 2140 E7CB.tmp 95 PID 2332 wrote to memory of 4948 2332 E848.tmp 96 PID 4948 wrote to memory of 5924 4948 E8B5.tmp 97 PID 5924 wrote to memory of 792 5924 E951.tmp 98 PID 792 wrote to memory of 4468 792 E9AF.tmp 99 PID 4468 wrote to memory of 4540 4468 EA4B.tmp 100 PID 4540 wrote to memory of 4596 4540 EAB9.tmp 101 PID 4596 wrote to memory of 3396 4596 EB26.tmp 102 PID 3396 wrote to memory of 5864 3396 EBB3.tmp 103 PID 5864 wrote to memory of 820 5864 EC4F.tmp 104 PID 820 wrote to memory of 616 820 ECDC.tmp 105 PID 616 wrote to memory of 5388 616 ED78.tmp 106 PID 5388 wrote to memory of 3928 5388 EDD6.tmp 107 PID 3928 wrote to memory of 1580 3928 EE72.tmp 108 PID 1580 wrote to memory of 4340 1580 EEEF.tmp 109 PID 4340 wrote to memory of 2524 4340 EF8B.tmp 110 PID 2524 wrote to memory of 3768 2524 F027.tmp 111 PID 3768 wrote to memory of 1752 3768 F0C4.tmp 112 PID 1752 wrote to memory of 4080 1752 F150.tmp 113 PID 4080 wrote to memory of 2296 4080 F1BE.tmp 114 PID 2296 wrote to memory of 2324 2296 F23B.tmp 115 PID 2324 wrote to memory of 6088 2324 F298.tmp 116 PID 6088 wrote to memory of 256 6088 F335.tmp 117 PID 256 wrote to memory of 3772 256 F3D1.tmp 118 PID 3772 wrote to memory of 4388 3772 F43E.tmp 119 PID 4388 wrote to memory of 5472 4388 F4CB.tmp 120 PID 5472 wrote to memory of 3700 5472 F548.tmp 121 PID 3700 wrote to memory of 3864 3700 F596.tmp 122 PID 3864 wrote to memory of 5464 3864 F5F4.tmp 123 PID 5464 wrote to memory of 2556 5464 F661.tmp 124 PID 2556 wrote to memory of 5392 2556 F6BF.tmp 125 PID 5392 wrote to memory of 4928 5392 F71D.tmp 126 PID 4928 wrote to memory of 3264 4928 F78A.tmp 127 PID 3264 wrote to memory of 548 3264 F7F7.tmp 128 PID 548 wrote to memory of 4084 548 F855.tmp 129 PID 4084 wrote to memory of 2964 4084 F8B3.tmp 130 PID 2964 wrote to memory of 4820 2964 F911.tmp 131 PID 4820 wrote to memory of 2796 4820 F98E.tmp 132 PID 2796 wrote to memory of 3260 2796 F9EB.tmp 133 PID 3260 wrote to memory of 1124 3260 FA49.tmp 134 PID 1124 wrote to memory of 2340 1124 FAA7.tmp 135 PID 2340 wrote to memory of 1396 2340 FB05.tmp 136 PID 1396 wrote to memory of 3352 1396 FB62.tmp 137 PID 3352 wrote to memory of 2436 3352 FBD0.tmp 138 PID 2436 wrote to memory of 844 2436 FC2E.tmp 139 PID 844 wrote to memory of 2096 844 FCAB.tmp 140 PID 2096 wrote to memory of 4712 2096 FCF9.tmp 141 PID 4712 wrote to memory of 3472 4712 FD66.tmp 142 PID 3472 wrote to memory of 1176 3472 FDC4.tmp 143 PID 1176 wrote to memory of 1812 1176 FE22.tmp 144 PID 1812 wrote to memory of 2568 1812 FE7F.tmp 145 PID 2568 wrote to memory of 4320 2568 FEDD.tmp 146 PID 4320 wrote to memory of 4236 4320 FF3B.tmp 147 PID 4236 wrote to memory of 2360 4236 FF99.tmp 148 PID 2360 wrote to memory of 2944 2360 FFF6.tmp 149 PID 2944 wrote to memory of 2028 2944 54.tmp 150 PID 2028 wrote to memory of 5868 2028 A2.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_ef938a49919617091bb2f898f51fe400_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_ef938a49919617091bb2f898f51fe400_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\E47F.tmp"C:\Users\Admin\AppData\Local\Temp\E47F.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\E51B.tmp"C:\Users\Admin\AppData\Local\Temp\E51B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\E5B8.tmp"C:\Users\Admin\AppData\Local\Temp\E5B8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\E663.tmp"C:\Users\Admin\AppData\Local\Temp\E663.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\E6E0.tmp"C:\Users\Admin\AppData\Local\Temp\E6E0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\E74E.tmp"C:\Users\Admin\AppData\Local\Temp\E74E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\E7CB.tmp"C:\Users\Admin\AppData\Local\Temp\E7CB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\E848.tmp"C:\Users\Admin\AppData\Local\Temp\E848.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\E8B5.tmp"C:\Users\Admin\AppData\Local\Temp\E8B5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\E951.tmp"C:\Users\Admin\AppData\Local\Temp\E951.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\E9AF.tmp"C:\Users\Admin\AppData\Local\Temp\E9AF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\EA4B.tmp"C:\Users\Admin\AppData\Local\Temp\EA4B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\EAB9.tmp"C:\Users\Admin\AppData\Local\Temp\EAB9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\EB26.tmp"C:\Users\Admin\AppData\Local\Temp\EB26.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\EC4F.tmp"C:\Users\Admin\AppData\Local\Temp\EC4F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\ECDC.tmp"C:\Users\Admin\AppData\Local\Temp\ECDC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\ED78.tmp"C:\Users\Admin\AppData\Local\Temp\ED78.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\EDD6.tmp"C:\Users\Admin\AppData\Local\Temp\EDD6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\EE72.tmp"C:\Users\Admin\AppData\Local\Temp\EE72.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\EEEF.tmp"C:\Users\Admin\AppData\Local\Temp\EEEF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\EF8B.tmp"C:\Users\Admin\AppData\Local\Temp\EF8B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\F027.tmp"C:\Users\Admin\AppData\Local\Temp\F027.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\F0C4.tmp"C:\Users\Admin\AppData\Local\Temp\F0C4.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\F150.tmp"C:\Users\Admin\AppData\Local\Temp\F150.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"C:\Users\Admin\AppData\Local\Temp\F1BE.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\F23B.tmp"C:\Users\Admin\AppData\Local\Temp\F23B.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\F298.tmp"C:\Users\Admin\AppData\Local\Temp\F298.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:256 -
C:\Users\Admin\AppData\Local\Temp\F43E.tmp"C:\Users\Admin\AppData\Local\Temp\F43E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\F548.tmp"C:\Users\Admin\AppData\Local\Temp\F548.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\F596.tmp"C:\Users\Admin\AppData\Local\Temp\F596.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\F5F4.tmp"C:\Users\Admin\AppData\Local\Temp\F5F4.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\F661.tmp"C:\Users\Admin\AppData\Local\Temp\F661.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\F6BF.tmp"C:\Users\Admin\AppData\Local\Temp\F6BF.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\F71D.tmp"C:\Users\Admin\AppData\Local\Temp\F71D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\F78A.tmp"C:\Users\Admin\AppData\Local\Temp\F78A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\F7F7.tmp"C:\Users\Admin\AppData\Local\Temp\F7F7.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\F855.tmp"C:\Users\Admin\AppData\Local\Temp\F855.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\F8B3.tmp"C:\Users\Admin\AppData\Local\Temp\F8B3.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\F911.tmp"C:\Users\Admin\AppData\Local\Temp\F911.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\F98E.tmp"C:\Users\Admin\AppData\Local\Temp\F98E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\F9EB.tmp"C:\Users\Admin\AppData\Local\Temp\F9EB.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\FA49.tmp"C:\Users\Admin\AppData\Local\Temp\FA49.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\FAA7.tmp"C:\Users\Admin\AppData\Local\Temp\FAA7.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\FB05.tmp"C:\Users\Admin\AppData\Local\Temp\FB05.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\FB62.tmp"C:\Users\Admin\AppData\Local\Temp\FB62.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\FBD0.tmp"C:\Users\Admin\AppData\Local\Temp\FBD0.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\FC2E.tmp"C:\Users\Admin\AppData\Local\Temp\FC2E.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\FCAB.tmp"C:\Users\Admin\AppData\Local\Temp\FCAB.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\FCF9.tmp"C:\Users\Admin\AppData\Local\Temp\FCF9.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\FD66.tmp"C:\Users\Admin\AppData\Local\Temp\FD66.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\FDC4.tmp"C:\Users\Admin\AppData\Local\Temp\FDC4.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\FE22.tmp"C:\Users\Admin\AppData\Local\Temp\FE22.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\FE7F.tmp"C:\Users\Admin\AppData\Local\Temp\FE7F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\FEDD.tmp"C:\Users\Admin\AppData\Local\Temp\FEDD.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\FF99.tmp"C:\Users\Admin\AppData\Local\Temp\FF99.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\FFF6.tmp"C:\Users\Admin\AppData\Local\Temp\FFF6.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\54.tmp"C:\Users\Admin\AppData\Local\Temp\54.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\A2.tmp"C:\Users\Admin\AppData\Local\Temp\A2.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\110.tmp"C:\Users\Admin\AppData\Local\Temp\110.tmp"65⤵
- Executes dropped EXE
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\17D.tmp"C:\Users\Admin\AppData\Local\Temp\17D.tmp"66⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\1DB.tmp"C:\Users\Admin\AppData\Local\Temp\1DB.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\238.tmp"C:\Users\Admin\AppData\Local\Temp\238.tmp"68⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\296.tmp"C:\Users\Admin\AppData\Local\Temp\296.tmp"69⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\2F4.tmp"C:\Users\Admin\AppData\Local\Temp\2F4.tmp"70⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\352.tmp"C:\Users\Admin\AppData\Local\Temp\352.tmp"71⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\3BF.tmp"C:\Users\Admin\AppData\Local\Temp\3BF.tmp"72⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\41D.tmp"C:\Users\Admin\AppData\Local\Temp\41D.tmp"73⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\47B.tmp"C:\Users\Admin\AppData\Local\Temp\47B.tmp"74⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\4D8.tmp"C:\Users\Admin\AppData\Local\Temp\4D8.tmp"75⤵PID:5748
-
C:\Users\Admin\AppData\Local\Temp\536.tmp"C:\Users\Admin\AppData\Local\Temp\536.tmp"76⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\594.tmp"C:\Users\Admin\AppData\Local\Temp\594.tmp"77⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\601.tmp"C:\Users\Admin\AppData\Local\Temp\601.tmp"78⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\65F.tmp"C:\Users\Admin\AppData\Local\Temp\65F.tmp"79⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\6CC.tmp"C:\Users\Admin\AppData\Local\Temp\6CC.tmp"80⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\73A.tmp"C:\Users\Admin\AppData\Local\Temp\73A.tmp"81⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\797.tmp"C:\Users\Admin\AppData\Local\Temp\797.tmp"82⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\7E6.tmp"C:\Users\Admin\AppData\Local\Temp\7E6.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\843.tmp"C:\Users\Admin\AppData\Local\Temp\843.tmp"84⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\8C0.tmp"C:\Users\Admin\AppData\Local\Temp\8C0.tmp"85⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\91E.tmp"C:\Users\Admin\AppData\Local\Temp\91E.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\98B.tmp"C:\Users\Admin\AppData\Local\Temp\98B.tmp"87⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\9E9.tmp"C:\Users\Admin\AppData\Local\Temp\9E9.tmp"88⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\A47.tmp"C:\Users\Admin\AppData\Local\Temp\A47.tmp"89⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\AA5.tmp"C:\Users\Admin\AppData\Local\Temp\AA5.tmp"90⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\AF3.tmp"C:\Users\Admin\AppData\Local\Temp\AF3.tmp"91⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\B51.tmp"C:\Users\Admin\AppData\Local\Temp\B51.tmp"92⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\BAE.tmp"C:\Users\Admin\AppData\Local\Temp\BAE.tmp"93⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\C1C.tmp"C:\Users\Admin\AppData\Local\Temp\C1C.tmp"94⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\C6A.tmp"C:\Users\Admin\AppData\Local\Temp\C6A.tmp"95⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\CC8.tmp"C:\Users\Admin\AppData\Local\Temp\CC8.tmp"96⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\D35.tmp"C:\Users\Admin\AppData\Local\Temp\D35.tmp"97⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\D93.tmp"C:\Users\Admin\AppData\Local\Temp\D93.tmp"98⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\DE1.tmp"C:\Users\Admin\AppData\Local\Temp\DE1.tmp"99⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\E5E.tmp"C:\Users\Admin\AppData\Local\Temp\E5E.tmp"100⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\EBC.tmp"C:\Users\Admin\AppData\Local\Temp\EBC.tmp"101⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\F29.tmp"C:\Users\Admin\AppData\Local\Temp\F29.tmp"102⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\F87.tmp"C:\Users\Admin\AppData\Local\Temp\F87.tmp"103⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\FF4.tmp"C:\Users\Admin\AppData\Local\Temp\FF4.tmp"104⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\1052.tmp"C:\Users\Admin\AppData\Local\Temp\1052.tmp"105⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\10B0.tmp"C:\Users\Admin\AppData\Local\Temp\10B0.tmp"106⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\110D.tmp"C:\Users\Admin\AppData\Local\Temp\110D.tmp"107⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\116B.tmp"C:\Users\Admin\AppData\Local\Temp\116B.tmp"108⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\11C9.tmp"C:\Users\Admin\AppData\Local\Temp\11C9.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\1227.tmp"C:\Users\Admin\AppData\Local\Temp\1227.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\1284.tmp"C:\Users\Admin\AppData\Local\Temp\1284.tmp"111⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\12F2.tmp"C:\Users\Admin\AppData\Local\Temp\12F2.tmp"112⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\135F.tmp"C:\Users\Admin\AppData\Local\Temp\135F.tmp"113⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\13CC.tmp"C:\Users\Admin\AppData\Local\Temp\13CC.tmp"114⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\142A.tmp"C:\Users\Admin\AppData\Local\Temp\142A.tmp"115⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\1488.tmp"C:\Users\Admin\AppData\Local\Temp\1488.tmp"116⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\14E6.tmp"C:\Users\Admin\AppData\Local\Temp\14E6.tmp"117⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\1543.tmp"C:\Users\Admin\AppData\Local\Temp\1543.tmp"118⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\15A1.tmp"C:\Users\Admin\AppData\Local\Temp\15A1.tmp"119⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\15FF.tmp"C:\Users\Admin\AppData\Local\Temp\15FF.tmp"120⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\165D.tmp"C:\Users\Admin\AppData\Local\Temp\165D.tmp"121⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\16BA.tmp"C:\Users\Admin\AppData\Local\Temp\16BA.tmp"122⤵PID:2384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-