Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/07/2026, 06:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-04_cec9ad91e0a0b5c812605156186e75e1_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-04_cec9ad91e0a0b5c812605156186e75e1_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 2026-07-04_cec9ad91e0a0b5c812605156186e75e1_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260704-hamjlsf14m
- SHA256 b596e221b15827035a465a3c8dc7a571b9a8fda1f3e30b29aa1313b17833da6a
- MD5 cec9ad91e0a0b5c812605156186e75e1
- SHA1 1569b358aa58dd541e8ea2ed83573aa76f13a8ab
- SHA512 cba264dad60b71b38708574f66510a5fd1dc2efc3c49463729a060567d966881ebc11c0d31257d415bfd11601e79b52f223d3809772121c380261d1f1f28c204
- SSDEEP 12288:wU5rCOTeiDzdyfBoxbpOBVd9HvMORz8NZ+3/v+I9hUG2VA:wUQOJDzdyeraBHEOd8NGEA
- TLSH T171E4D02173D8C532E9F7037859B5E6655A7EBD326722D6CF2F8011AE19B1BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2140 D954.tmp 4492 DA0F.tmp 5204 DACB.tmp 6164 DBB5.tmp 5776 DC61.tmp 1712 DD6B.tmp 5916 DDE8.tmp 5864 DEA3.tmp 7108 DF4F.tmp 7028 E02A.tmp 7056 E114.tmp 2004 E1D0.tmp 3088 E27B.tmp 6100 E375.tmp 6776 E460.tmp 796 E52B.tmp 2024 E5E6.tmp 6372 E692.tmp 7164 E72F.tmp 3836 E7DA.tmp 6692 E877.tmp 1596 E961.tmp 3296 EA1D.tmp 6900 EB26.tmp 6800 EBF1.tmp 5756 EC9D.tmp 2572 ED59.tmp 4896 EE05.tmp 5020 EEC0.tmp 1464 EF7C.tmp 6952 F047.tmp 2788 F131.tmp 4168 F1ED.tmp 4796 F279.tmp 4996 F2F6.tmp 4408 F392.tmp 1188 F41F.tmp 2036 F4CB.tmp 3868 F567.tmp 4064 F5E4.tmp 4924 F642.tmp 6540 F6EE.tmp 2088 F75B.tmp 5400 F7B9.tmp 4764 F865.tmp 3244 F901.tmp 1632 F96E.tmp 3264 F9FB.tmp 1820 FA88.tmp 2984 FAE5.tmp 52 FB43.tmp 1608 FBB1.tmp 1732 FC1E.tmp 6732 FC9B.tmp 5748 FCF9.tmp 884 FD56.tmp 2564 FDC4.tmp 3948 FE22.tmp 6284 FE7F.tmp 2432 FEDD.tmp 4324 FF3B.tmp 5180 FFA8.tmp 1064 6.tmp 3724 64.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7584.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E02A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D315.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8757.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A166.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7744.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 795C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A28F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2447.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E877.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5673.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F67C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F747.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A781.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3588.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 567E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4339.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 257B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FD0.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5876 wrote to memory of 2140 5876 2026-07-04_cec9ad91e0a0b5c812605156186e75e1_elex_mafia_stealc_tofsee.exe 89 PID 2140 wrote to memory of 4492 2140 D954.tmp 90 PID 4492 wrote to memory of 5204 4492 DA0F.tmp 91 PID 5204 wrote to memory of 6164 5204 DACB.tmp 92 PID 6164 wrote to memory of 5776 6164 DBB5.tmp 93 PID 5776 wrote to memory of 1712 5776 DC61.tmp 94 PID 1712 wrote to memory of 5916 1712 DD6B.tmp 95 PID 5916 wrote to memory of 5864 5916 DDE8.tmp 96 PID 5864 wrote to memory of 7108 5864 DEA3.tmp 97 PID 7108 wrote to memory of 7028 7108 DF4F.tmp 98 PID 7028 wrote to memory of 7056 7028 E02A.tmp 99 PID 7056 wrote to memory of 2004 7056 E114.tmp 100 PID 2004 wrote to memory of 3088 2004 E1D0.tmp 101 PID 3088 wrote to memory of 6100 3088 E27B.tmp 102 PID 6100 wrote to memory of 6776 6100 E375.tmp 103 PID 6776 wrote to memory of 796 6776 E460.tmp 104 PID 796 wrote to memory of 2024 796 E52B.tmp 105 PID 2024 wrote to memory of 6372 2024 E5E6.tmp 106 PID 6372 wrote to memory of 7164 6372 E692.tmp 107 PID 7164 wrote to memory of 3836 7164 E72F.tmp 108 PID 3836 wrote to memory of 6692 3836 E7DA.tmp 109 PID 6692 wrote to memory of 1596 6692 E877.tmp 110 PID 1596 wrote to memory of 3296 1596 E961.tmp 111 PID 3296 wrote to memory of 6900 3296 EA1D.tmp 112 PID 6900 wrote to memory of 6800 6900 EB26.tmp 113 PID 6800 wrote to memory of 5756 6800 EBF1.tmp 114 PID 5756 wrote to memory of 2572 5756 EC9D.tmp 115 PID 2572 wrote to memory of 4896 2572 ED59.tmp 116 PID 4896 wrote to memory of 5020 4896 EE05.tmp 117 PID 5020 wrote to memory of 1464 5020 EEC0.tmp 118 PID 1464 wrote to memory of 6952 1464 EF7C.tmp 119 PID 6952 wrote to memory of 2788 6952 F047.tmp 120 PID 2788 wrote to memory of 4168 2788 F131.tmp 121 PID 4168 wrote to memory of 4796 4168 F1ED.tmp 122 PID 4796 wrote to memory of 4996 4796 F279.tmp 123 PID 4996 wrote to memory of 4408 4996 F2F6.tmp 124 PID 4408 wrote to memory of 1188 4408 F392.tmp 125 PID 1188 wrote to memory of 2036 1188 F41F.tmp 126 PID 2036 wrote to memory of 3868 2036 F4CB.tmp 127 PID 3868 wrote to memory of 4064 3868 F567.tmp 128 PID 4064 wrote to memory of 4924 4064 F5E4.tmp 129 PID 4924 wrote to memory of 6540 4924 F642.tmp 130 PID 6540 wrote to memory of 2088 6540 F6EE.tmp 131 PID 2088 wrote to memory of 5400 2088 F75B.tmp 132 PID 5400 wrote to memory of 4764 5400 F7B9.tmp 133 PID 4764 wrote to memory of 3244 4764 F865.tmp 134 PID 3244 wrote to memory of 1632 3244 F901.tmp 135 PID 1632 wrote to memory of 3264 1632 F96E.tmp 136 PID 3264 wrote to memory of 1820 3264 F9FB.tmp 137 PID 1820 wrote to memory of 2984 1820 FA88.tmp 138 PID 2984 wrote to memory of 52 2984 FAE5.tmp 139 PID 52 wrote to memory of 1608 52 FB43.tmp 140 PID 1608 wrote to memory of 1732 1608 FBB1.tmp 141 PID 1732 wrote to memory of 6732 1732 FC1E.tmp 142 PID 6732 wrote to memory of 5748 6732 FC9B.tmp 143 PID 5748 wrote to memory of 884 5748 FCF9.tmp 144 PID 884 wrote to memory of 2564 884 FD56.tmp 145 PID 2564 wrote to memory of 3948 2564 FDC4.tmp 146 PID 3948 wrote to memory of 6284 3948 FE22.tmp 147 PID 6284 wrote to memory of 2432 6284 FE7F.tmp 148 PID 2432 wrote to memory of 4324 2432 FEDD.tmp 149 PID 4324 wrote to memory of 5180 4324 FF3B.tmp 150 PID 5180 wrote to memory of 1064 5180 FFA8.tmp 151 PID 1064 wrote to memory of 3724 1064 6.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_cec9ad91e0a0b5c812605156186e75e1_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_cec9ad91e0a0b5c812605156186e75e1_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\D954.tmp"C:\Users\Admin\AppData\Local\Temp\D954.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\DA0F.tmp"C:\Users\Admin\AppData\Local\Temp\DA0F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\DACB.tmp"C:\Users\Admin\AppData\Local\Temp\DACB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6164 -
C:\Users\Admin\AppData\Local\Temp\DC61.tmp"C:\Users\Admin\AppData\Local\Temp\DC61.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Users\Admin\AppData\Local\Temp\DD6B.tmp"C:\Users\Admin\AppData\Local\Temp\DD6B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\DDE8.tmp"C:\Users\Admin\AppData\Local\Temp\DDE8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\DEA3.tmp"C:\Users\Admin\AppData\Local\Temp\DEA3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Users\Admin\AppData\Local\Temp\DF4F.tmp"C:\Users\Admin\AppData\Local\Temp\DF4F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7108 -
C:\Users\Admin\AppData\Local\Temp\E02A.tmp"C:\Users\Admin\AppData\Local\Temp\E02A.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7028 -
C:\Users\Admin\AppData\Local\Temp\E114.tmp"C:\Users\Admin\AppData\Local\Temp\E114.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7056 -
C:\Users\Admin\AppData\Local\Temp\E1D0.tmp"C:\Users\Admin\AppData\Local\Temp\E1D0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\E27B.tmp"C:\Users\Admin\AppData\Local\Temp\E27B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\E375.tmp"C:\Users\Admin\AppData\Local\Temp\E375.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\E460.tmp"C:\Users\Admin\AppData\Local\Temp\E460.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6776 -
C:\Users\Admin\AppData\Local\Temp\E52B.tmp"C:\Users\Admin\AppData\Local\Temp\E52B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\E692.tmp"C:\Users\Admin\AppData\Local\Temp\E692.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6372 -
C:\Users\Admin\AppData\Local\Temp\E72F.tmp"C:\Users\Admin\AppData\Local\Temp\E72F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:7164 -
C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\E877.tmp"C:\Users\Admin\AppData\Local\Temp\E877.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6692 -
C:\Users\Admin\AppData\Local\Temp\E961.tmp"C:\Users\Admin\AppData\Local\Temp\E961.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\EA1D.tmp"C:\Users\Admin\AppData\Local\Temp\EA1D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\EB26.tmp"C:\Users\Admin\AppData\Local\Temp\EB26.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6900 -
C:\Users\Admin\AppData\Local\Temp\EBF1.tmp"C:\Users\Admin\AppData\Local\Temp\EBF1.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6800 -
C:\Users\Admin\AppData\Local\Temp\EC9D.tmp"C:\Users\Admin\AppData\Local\Temp\EC9D.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\ED59.tmp"C:\Users\Admin\AppData\Local\Temp\ED59.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\EE05.tmp"C:\Users\Admin\AppData\Local\Temp\EE05.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\EEC0.tmp"C:\Users\Admin\AppData\Local\Temp\EEC0.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\EF7C.tmp"C:\Users\Admin\AppData\Local\Temp\EF7C.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\F047.tmp"C:\Users\Admin\AppData\Local\Temp\F047.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6952 -
C:\Users\Admin\AppData\Local\Temp\F131.tmp"C:\Users\Admin\AppData\Local\Temp\F131.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\F1ED.tmp"C:\Users\Admin\AppData\Local\Temp\F1ED.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\F279.tmp"C:\Users\Admin\AppData\Local\Temp\F279.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\F392.tmp"C:\Users\Admin\AppData\Local\Temp\F392.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\F41F.tmp"C:\Users\Admin\AppData\Local\Temp\F41F.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\F567.tmp"C:\Users\Admin\AppData\Local\Temp\F567.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\F5E4.tmp"C:\Users\Admin\AppData\Local\Temp\F5E4.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\F642.tmp"C:\Users\Admin\AppData\Local\Temp\F642.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"C:\Users\Admin\AppData\Local\Temp\F6EE.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6540 -
C:\Users\Admin\AppData\Local\Temp\F75B.tmp"C:\Users\Admin\AppData\Local\Temp\F75B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\F7B9.tmp"C:\Users\Admin\AppData\Local\Temp\F7B9.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Users\Admin\AppData\Local\Temp\F865.tmp"C:\Users\Admin\AppData\Local\Temp\F865.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\F901.tmp"C:\Users\Admin\AppData\Local\Temp\F901.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\F96E.tmp"C:\Users\Admin\AppData\Local\Temp\F96E.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\F9FB.tmp"C:\Users\Admin\AppData\Local\Temp\F9FB.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\FA88.tmp"C:\Users\Admin\AppData\Local\Temp\FA88.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\FAE5.tmp"C:\Users\Admin\AppData\Local\Temp\FAE5.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\FB43.tmp"C:\Users\Admin\AppData\Local\Temp\FB43.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Users\Admin\AppData\Local\Temp\FBB1.tmp"C:\Users\Admin\AppData\Local\Temp\FBB1.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\FC1E.tmp"C:\Users\Admin\AppData\Local\Temp\FC1E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\FC9B.tmp"C:\Users\Admin\AppData\Local\Temp\FC9B.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6732 -
C:\Users\Admin\AppData\Local\Temp\FCF9.tmp"C:\Users\Admin\AppData\Local\Temp\FCF9.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\FD56.tmp"C:\Users\Admin\AppData\Local\Temp\FD56.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\FDC4.tmp"C:\Users\Admin\AppData\Local\Temp\FDC4.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\FE22.tmp"C:\Users\Admin\AppData\Local\Temp\FE22.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\FE7F.tmp"C:\Users\Admin\AppData\Local\Temp\FE7F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6284 -
C:\Users\Admin\AppData\Local\Temp\FEDD.tmp"C:\Users\Admin\AppData\Local\Temp\FEDD.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\FFA8.tmp"C:\Users\Admin\AppData\Local\Temp\FFA8.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\6.tmp"C:\Users\Admin\AppData\Local\Temp\6.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\64.tmp"C:\Users\Admin\AppData\Local\Temp\64.tmp"65⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\C1.tmp"C:\Users\Admin\AppData\Local\Temp\C1.tmp"66⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\11F.tmp"C:\Users\Admin\AppData\Local\Temp\11F.tmp"67⤵PID:6968
-
C:\Users\Admin\AppData\Local\Temp\18D.tmp"C:\Users\Admin\AppData\Local\Temp\18D.tmp"68⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\1EA.tmp"C:\Users\Admin\AppData\Local\Temp\1EA.tmp"69⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\248.tmp"C:\Users\Admin\AppData\Local\Temp\248.tmp"70⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\2A6.tmp"C:\Users\Admin\AppData\Local\Temp\2A6.tmp"71⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\313.tmp"C:\Users\Admin\AppData\Local\Temp\313.tmp"72⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\371.tmp"C:\Users\Admin\AppData\Local\Temp\371.tmp"73⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\3CF.tmp"C:\Users\Admin\AppData\Local\Temp\3CF.tmp"74⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\43C.tmp"C:\Users\Admin\AppData\Local\Temp\43C.tmp"75⤵PID:6676
-
C:\Users\Admin\AppData\Local\Temp\49A.tmp"C:\Users\Admin\AppData\Local\Temp\49A.tmp"76⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\4F8.tmp"C:\Users\Admin\AppData\Local\Temp\4F8.tmp"77⤵PID:7140
-
C:\Users\Admin\AppData\Local\Temp\565.tmp"C:\Users\Admin\AppData\Local\Temp\565.tmp"78⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\5C3.tmp"C:\Users\Admin\AppData\Local\Temp\5C3.tmp"79⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\630.tmp"C:\Users\Admin\AppData\Local\Temp\630.tmp"80⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\6AD.tmp"C:\Users\Admin\AppData\Local\Temp\6AD.tmp"81⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\71A.tmp"C:\Users\Admin\AppData\Local\Temp\71A.tmp"82⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\788.tmp"C:\Users\Admin\AppData\Local\Temp\788.tmp"83⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\7F5.tmp"C:\Users\Admin\AppData\Local\Temp\7F5.tmp"84⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\853.tmp"C:\Users\Admin\AppData\Local\Temp\853.tmp"85⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\8B1.tmp"C:\Users\Admin\AppData\Local\Temp\8B1.tmp"86⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\90E.tmp"C:\Users\Admin\AppData\Local\Temp\90E.tmp"87⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\96C.tmp"C:\Users\Admin\AppData\Local\Temp\96C.tmp"88⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\9DA.tmp"C:\Users\Admin\AppData\Local\Temp\9DA.tmp"89⤵PID:5388
-
C:\Users\Admin\AppData\Local\Temp\A37.tmp"C:\Users\Admin\AppData\Local\Temp\A37.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:7124 -
C:\Users\Admin\AppData\Local\Temp\A95.tmp"C:\Users\Admin\AppData\Local\Temp\A95.tmp"91⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\B02.tmp"C:\Users\Admin\AppData\Local\Temp\B02.tmp"92⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\B70.tmp"C:\Users\Admin\AppData\Local\Temp\B70.tmp"93⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\BDD.tmp"C:\Users\Admin\AppData\Local\Temp\BDD.tmp"94⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\C3B.tmp"C:\Users\Admin\AppData\Local\Temp\C3B.tmp"95⤵PID:6268
-
C:\Users\Admin\AppData\Local\Temp\CA8.tmp"C:\Users\Admin\AppData\Local\Temp\CA8.tmp"96⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\D16.tmp"C:\Users\Admin\AppData\Local\Temp\D16.tmp"97⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\D93.tmp"C:\Users\Admin\AppData\Local\Temp\D93.tmp"98⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\E00.tmp"C:\Users\Admin\AppData\Local\Temp\E00.tmp"99⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\E5E.tmp"C:\Users\Admin\AppData\Local\Temp\E5E.tmp"100⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\ECB.tmp"C:\Users\Admin\AppData\Local\Temp\ECB.tmp"101⤵PID:5948
-
C:\Users\Admin\AppData\Local\Temp\F39.tmp"C:\Users\Admin\AppData\Local\Temp\F39.tmp"102⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\F96.tmp"C:\Users\Admin\AppData\Local\Temp\F96.tmp"103⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\FF4.tmp"C:\Users\Admin\AppData\Local\Temp\FF4.tmp"104⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\1052.tmp"C:\Users\Admin\AppData\Local\Temp\1052.tmp"105⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\10B0.tmp"C:\Users\Admin\AppData\Local\Temp\10B0.tmp"106⤵PID:6896
-
C:\Users\Admin\AppData\Local\Temp\111D.tmp"C:\Users\Admin\AppData\Local\Temp\111D.tmp"107⤵PID:6792
-
C:\Users\Admin\AppData\Local\Temp\117B.tmp"C:\Users\Admin\AppData\Local\Temp\117B.tmp"108⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\11D8.tmp"C:\Users\Admin\AppData\Local\Temp\11D8.tmp"109⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\1236.tmp"C:\Users\Admin\AppData\Local\Temp\1236.tmp"110⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\12B3.tmp"C:\Users\Admin\AppData\Local\Temp\12B3.tmp"111⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\1311.tmp"C:\Users\Admin\AppData\Local\Temp\1311.tmp"112⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\137E.tmp"C:\Users\Admin\AppData\Local\Temp\137E.tmp"113⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\13DC.tmp"C:\Users\Admin\AppData\Local\Temp\13DC.tmp"114⤵PID:6228
-
C:\Users\Admin\AppData\Local\Temp\1449.tmp"C:\Users\Admin\AppData\Local\Temp\1449.tmp"115⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\14A7.tmp"C:\Users\Admin\AppData\Local\Temp\14A7.tmp"116⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\14F5.tmp"C:\Users\Admin\AppData\Local\Temp\14F5.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:7148 -
C:\Users\Admin\AppData\Local\Temp\1563.tmp"C:\Users\Admin\AppData\Local\Temp\1563.tmp"118⤵PID:6892
-
C:\Users\Admin\AppData\Local\Temp\15EF.tmp"C:\Users\Admin\AppData\Local\Temp\15EF.tmp"119⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\164D.tmp"C:\Users\Admin\AppData\Local\Temp\164D.tmp"120⤵PID:6408
-
C:\Users\Admin\AppData\Local\Temp\16AB.tmp"C:\Users\Admin\AppData\Local\Temp\16AB.tmp"121⤵PID:6604
-
C:\Users\Admin\AppData\Local\Temp\1709.tmp"C:\Users\Admin\AppData\Local\Temp\1709.tmp"122⤵PID:6000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-