Analysis
- max time kernel
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 03:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-05_ed2c453677350342cb5d99cbc7d7e686_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_ed2c453677350342cb5d99cbc7d7e686_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 2026-07-05_ed2c453677350342cb5d99cbc7d7e686_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260705-dxbcmscw5r
- SHA256 7dc2e56aee37388032db393ce15093810784e4d8f3746aa565a03efa6219da50
- MD5 ed2c453677350342cb5d99cbc7d7e686
- SHA1 b1377d6fe8217669065d63eadc44bdb29f061470
- SHA512 6d377b5f312d5c091f434a7bf44d2f252c44193e5c67a5a208eb475735d4999c57ab0881e5715c10601420640a8449d920aac99db00aa67c825f5f9e772d2479
- SSDEEP 12288:NU5rCOTeijdJIvTd/4PHkuzB1plUqHoeyIirTZwlH:NUQOJjdJIvTdwP/7nUqX0TSlH
- TLSH T188B4F125B644C032E68202710AD6EBB26A3E7C71572694C77BC8677E2F762E1E375307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4828 DB19.tmp 1156 DBA5.tmp 2468 DC42.tmp 2020 DCBF.tmp 6016 DD7A.tmp 1940 DE07.tmp 3768 DEC2.tmp 1412 DF7E.tmp 1668 E01A.tmp 3116 E0A7.tmp 5280 E143.tmp 1568 E20E.tmp 5544 E2CA.tmp 4988 E366.tmp 5476 E431.tmp 5704 E4BE.tmp 3328 E589.tmp 5560 E606.tmp 2224 E692.tmp 1152 E72F.tmp 1800 E7FA.tmp 3200 E8A6.tmp 1112 E951.tmp 5076 EA1D.tmp 2876 EAB9.tmp 2532 EB74.tmp 696 EC6E.tmp 2820 ED1A.tmp 4660 EE14.tmp 2916 EED0.tmp 4140 EF9B.tmp 260 F076.tmp 5928 F121.tmp 4980 F19E.tmp 5392 F20C.tmp 1732 F289.tmp 4820 F315.tmp 3984 F383.tmp 2500 F400.tmp 2628 F46D.tmp 3008 F509.tmp 3416 F586.tmp 4540 F613.tmp 3056 F6AF.tmp 4108 F72C.tmp 2704 F79A.tmp 5348 F836.tmp 3696 F8B3.tmp 3440 F920.tmp 5296 F99D.tmp 4652 FA0B.tmp 3524 FA97.tmp 2476 FB14.tmp 2896 FB91.tmp 6020 FBFF.tmp 1976 FC8B.tmp 4084 FD08.tmp 3352 FD95.tmp 2448 FE02.tmp 3224 FE70.tmp 4520 FEDD.tmp 6136 FF5A.tmp 3392 6.tmp 3464 93.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6826.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 938C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D400.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1406.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8185.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 859C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 908E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 129F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4462.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E366.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E692.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 625A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7408.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 741D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BABB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9878.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5092.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 496E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A47F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F003.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7229.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2215.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C28B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B20B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9665.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C104.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EB2.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2544 wrote to memory of 4828 2544 2026-07-05_ed2c453677350342cb5d99cbc7d7e686_elex_mafia_stealc_tofsee.exe 88 PID 4828 wrote to memory of 1156 4828 DB19.tmp 89 PID 1156 wrote to memory of 2468 1156 DBA5.tmp 90 PID 2468 wrote to memory of 2020 2468 DC42.tmp 91 PID 2020 wrote to memory of 6016 2020 DCBF.tmp 92 PID 6016 wrote to memory of 1940 6016 DD7A.tmp 93 PID 1940 wrote to memory of 3768 1940 DE07.tmp 94 PID 3768 wrote to memory of 1412 3768 DEC2.tmp 95 PID 1412 wrote to memory of 1668 1412 DF7E.tmp 96 PID 1668 wrote to memory of 3116 1668 E01A.tmp 97 PID 3116 wrote to memory of 5280 3116 E0A7.tmp 98 PID 5280 wrote to memory of 1568 5280 E143.tmp 99 PID 1568 wrote to memory of 5544 1568 E20E.tmp 100 PID 5544 wrote to memory of 4988 5544 E2CA.tmp 101 PID 4988 wrote to memory of 5476 4988 E366.tmp 102 PID 5476 wrote to memory of 5704 5476 E431.tmp 103 PID 5704 wrote to memory of 3328 5704 E4BE.tmp 104 PID 3328 wrote to memory of 5560 3328 E589.tmp 105 PID 5560 wrote to memory of 2224 5560 E606.tmp 106 PID 2224 wrote to memory of 1152 2224 E692.tmp 107 PID 1152 wrote to memory of 1800 1152 E72F.tmp 108 PID 1800 wrote to memory of 3200 1800 E7FA.tmp 109 PID 3200 wrote to memory of 1112 3200 E8A6.tmp 110 PID 1112 wrote to memory of 5076 1112 E951.tmp 111 PID 5076 wrote to memory of 2876 5076 EA1D.tmp 112 PID 2876 wrote to memory of 2532 2876 EAB9.tmp 113 PID 2532 wrote to memory of 696 2532 EB74.tmp 114 PID 696 wrote to memory of 2820 696 EC6E.tmp 115 PID 2820 wrote to memory of 4660 2820 ED1A.tmp 116 PID 4660 wrote to memory of 2916 4660 EE14.tmp 117 PID 2916 wrote to memory of 4140 2916 EED0.tmp 118 PID 4140 wrote to memory of 260 4140 EF9B.tmp 119 PID 260 wrote to memory of 5928 260 F076.tmp 120 PID 5928 wrote to memory of 4980 5928 F121.tmp 121 PID 4980 wrote to memory of 5392 4980 F19E.tmp 122 PID 5392 wrote to memory of 1732 5392 F20C.tmp 123 PID 1732 wrote to memory of 4820 1732 F289.tmp 124 PID 4820 wrote to memory of 3984 4820 F315.tmp 125 PID 3984 wrote to memory of 2500 3984 F383.tmp 126 PID 2500 wrote to memory of 2628 2500 F400.tmp 127 PID 2628 wrote to memory of 3008 2628 F46D.tmp 128 PID 3008 wrote to memory of 3416 3008 F509.tmp 129 PID 3416 wrote to memory of 4540 3416 F586.tmp 130 PID 4540 wrote to memory of 3056 4540 F613.tmp 131 PID 3056 wrote to memory of 4108 3056 F6AF.tmp 132 PID 4108 wrote to memory of 2704 4108 F72C.tmp 133 PID 2704 wrote to memory of 5348 2704 F79A.tmp 134 PID 5348 wrote to memory of 3696 5348 F836.tmp 135 PID 3696 wrote to memory of 3440 3696 F8B3.tmp 136 PID 3440 wrote to memory of 5296 3440 F920.tmp 137 PID 5296 wrote to memory of 4652 5296 F99D.tmp 138 PID 4652 wrote to memory of 3524 4652 FA0B.tmp 139 PID 3524 wrote to memory of 2476 3524 FA97.tmp 140 PID 2476 wrote to memory of 2896 2476 FB14.tmp 141 PID 2896 wrote to memory of 6020 2896 FB91.tmp 142 PID 6020 wrote to memory of 1976 6020 FBFF.tmp 143 PID 1976 wrote to memory of 4084 1976 FC8B.tmp 144 PID 4084 wrote to memory of 3352 4084 FD08.tmp 145 PID 3352 wrote to memory of 2448 3352 FD95.tmp 146 PID 2448 wrote to memory of 3224 2448 FE02.tmp 147 PID 3224 wrote to memory of 4520 3224 FE70.tmp 148 PID 4520 wrote to memory of 6136 4520 FEDD.tmp 149 PID 6136 wrote to memory of 3392 6136 FF5A.tmp 150 PID 3392 wrote to memory of 3464 3392 6.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_ed2c453677350342cb5d99cbc7d7e686_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_ed2c453677350342cb5d99cbc7d7e686_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\DB19.tmp"C:\Users\Admin\AppData\Local\Temp\DB19.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\DBA5.tmp"C:\Users\Admin\AppData\Local\Temp\DBA5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\DC42.tmp"C:\Users\Admin\AppData\Local\Temp\DC42.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\DCBF.tmp"C:\Users\Admin\AppData\Local\Temp\DCBF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Users\Admin\AppData\Local\Temp\DE07.tmp"C:\Users\Admin\AppData\Local\Temp\DE07.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\DEC2.tmp"C:\Users\Admin\AppData\Local\Temp\DEC2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\DF7E.tmp"C:\Users\Admin\AppData\Local\Temp\DF7E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\E01A.tmp"C:\Users\Admin\AppData\Local\Temp\E01A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\E0A7.tmp"C:\Users\Admin\AppData\Local\Temp\E0A7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\E143.tmp"C:\Users\Admin\AppData\Local\Temp\E143.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\E20E.tmp"C:\Users\Admin\AppData\Local\Temp\E20E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\E2CA.tmp"C:\Users\Admin\AppData\Local\Temp\E2CA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\E366.tmp"C:\Users\Admin\AppData\Local\Temp\E366.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\E431.tmp"C:\Users\Admin\AppData\Local\Temp\E431.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Users\Admin\AppData\Local\Temp\E4BE.tmp"C:\Users\Admin\AppData\Local\Temp\E4BE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\E589.tmp"C:\Users\Admin\AppData\Local\Temp\E589.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\E606.tmp"C:\Users\Admin\AppData\Local\Temp\E606.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Users\Admin\AppData\Local\Temp\E692.tmp"C:\Users\Admin\AppData\Local\Temp\E692.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\E72F.tmp"C:\Users\Admin\AppData\Local\Temp\E72F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\E7FA.tmp"C:\Users\Admin\AppData\Local\Temp\E7FA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\E8A6.tmp"C:\Users\Admin\AppData\Local\Temp\E8A6.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\E951.tmp"C:\Users\Admin\AppData\Local\Temp\E951.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\EA1D.tmp"C:\Users\Admin\AppData\Local\Temp\EA1D.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\EAB9.tmp"C:\Users\Admin\AppData\Local\Temp\EAB9.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\EB74.tmp"C:\Users\Admin\AppData\Local\Temp\EB74.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\ED1A.tmp"C:\Users\Admin\AppData\Local\Temp\ED1A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\EE14.tmp"C:\Users\Admin\AppData\Local\Temp\EE14.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\EED0.tmp"C:\Users\Admin\AppData\Local\Temp\EED0.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\EF9B.tmp"C:\Users\Admin\AppData\Local\Temp\EF9B.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\F076.tmp"C:\Users\Admin\AppData\Local\Temp\F076.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\F121.tmp"C:\Users\Admin\AppData\Local\Temp\F121.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Users\Admin\AppData\Local\Temp\F19E.tmp"C:\Users\Admin\AppData\Local\Temp\F19E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\F20C.tmp"C:\Users\Admin\AppData\Local\Temp\F20C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\F289.tmp"C:\Users\Admin\AppData\Local\Temp\F289.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\F315.tmp"C:\Users\Admin\AppData\Local\Temp\F315.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\F383.tmp"C:\Users\Admin\AppData\Local\Temp\F383.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\F400.tmp"C:\Users\Admin\AppData\Local\Temp\F400.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\F46D.tmp"C:\Users\Admin\AppData\Local\Temp\F46D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\F509.tmp"C:\Users\Admin\AppData\Local\Temp\F509.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\F586.tmp"C:\Users\Admin\AppData\Local\Temp\F586.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\F613.tmp"C:\Users\Admin\AppData\Local\Temp\F613.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\F6AF.tmp"C:\Users\Admin\AppData\Local\Temp\F6AF.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\F72C.tmp"C:\Users\Admin\AppData\Local\Temp\F72C.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\F79A.tmp"C:\Users\Admin\AppData\Local\Temp\F79A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\F836.tmp"C:\Users\Admin\AppData\Local\Temp\F836.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5348 -
C:\Users\Admin\AppData\Local\Temp\F8B3.tmp"C:\Users\Admin\AppData\Local\Temp\F8B3.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\F920.tmp"C:\Users\Admin\AppData\Local\Temp\F920.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\F99D.tmp"C:\Users\Admin\AppData\Local\Temp\F99D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\FA0B.tmp"C:\Users\Admin\AppData\Local\Temp\FA0B.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\FA97.tmp"C:\Users\Admin\AppData\Local\Temp\FA97.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\FB14.tmp"C:\Users\Admin\AppData\Local\Temp\FB14.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\FB91.tmp"C:\Users\Admin\AppData\Local\Temp\FB91.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\FC8B.tmp"C:\Users\Admin\AppData\Local\Temp\FC8B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\FD08.tmp"C:\Users\Admin\AppData\Local\Temp\FD08.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\FD95.tmp"C:\Users\Admin\AppData\Local\Temp\FD95.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\FE02.tmp"C:\Users\Admin\AppData\Local\Temp\FE02.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\FE70.tmp"C:\Users\Admin\AppData\Local\Temp\FE70.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\FEDD.tmp"C:\Users\Admin\AppData\Local\Temp\FEDD.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\FF5A.tmp"C:\Users\Admin\AppData\Local\Temp\FF5A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Users\Admin\AppData\Local\Temp\6.tmp"C:\Users\Admin\AppData\Local\Temp\6.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\93.tmp"C:\Users\Admin\AppData\Local\Temp\93.tmp"65⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\12F.tmp"C:\Users\Admin\AppData\Local\Temp\12F.tmp"66⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\1CB.tmp"C:\Users\Admin\AppData\Local\Temp\1CB.tmp"67⤵PID:5548
-
C:\Users\Admin\AppData\Local\Temp\258.tmp"C:\Users\Admin\AppData\Local\Temp\258.tmp"68⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\2D5.tmp"C:\Users\Admin\AppData\Local\Temp\2D5.tmp"69⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\361.tmp"C:\Users\Admin\AppData\Local\Temp\361.tmp"70⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\3DE.tmp"C:\Users\Admin\AppData\Local\Temp\3DE.tmp"71⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\45B.tmp"C:\Users\Admin\AppData\Local\Temp\45B.tmp"72⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\4E8.tmp"C:\Users\Admin\AppData\Local\Temp\4E8.tmp"73⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\555.tmp"C:\Users\Admin\AppData\Local\Temp\555.tmp"74⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\5E2.tmp"C:\Users\Admin\AppData\Local\Temp\5E2.tmp"75⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\68E.tmp"C:\Users\Admin\AppData\Local\Temp\68E.tmp"76⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\70B.tmp"C:\Users\Admin\AppData\Local\Temp\70B.tmp"77⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\797.tmp"C:\Users\Admin\AppData\Local\Temp\797.tmp"78⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\805.tmp"C:\Users\Admin\AppData\Local\Temp\805.tmp"79⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\8A1.tmp"C:\Users\Admin\AppData\Local\Temp\8A1.tmp"80⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\92E.tmp"C:\Users\Admin\AppData\Local\Temp\92E.tmp"81⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\9AB.tmp"C:\Users\Admin\AppData\Local\Temp\9AB.tmp"82⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\A28.tmp"C:\Users\Admin\AppData\Local\Temp\A28.tmp"83⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\A95.tmp"C:\Users\Admin\AppData\Local\Temp\A95.tmp"84⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\B22.tmp"C:\Users\Admin\AppData\Local\Temp\B22.tmp"85⤵PID:5600
-
C:\Users\Admin\AppData\Local\Temp\BAE.tmp"C:\Users\Admin\AppData\Local\Temp\BAE.tmp"86⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\C2B.tmp"C:\Users\Admin\AppData\Local\Temp\C2B.tmp"87⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\C99.tmp"C:\Users\Admin\AppData\Local\Temp\C99.tmp"88⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\D25.tmp"C:\Users\Admin\AppData\Local\Temp\D25.tmp"89⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\DC2.tmp"C:\Users\Admin\AppData\Local\Temp\DC2.tmp"90⤵PID:5868
-
C:\Users\Admin\AppData\Local\Temp\E2F.tmp"C:\Users\Admin\AppData\Local\Temp\E2F.tmp"91⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\EAC.tmp"C:\Users\Admin\AppData\Local\Temp\EAC.tmp"92⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\F29.tmp"C:\Users\Admin\AppData\Local\Temp\F29.tmp"93⤵PID:5224
-
C:\Users\Admin\AppData\Local\Temp\FB6.tmp"C:\Users\Admin\AppData\Local\Temp\FB6.tmp"94⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\1033.tmp"C:\Users\Admin\AppData\Local\Temp\1033.tmp"95⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\10CF.tmp"C:\Users\Admin\AppData\Local\Temp\10CF.tmp"96⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\114C.tmp"C:\Users\Admin\AppData\Local\Temp\114C.tmp"97⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\11D8.tmp"C:\Users\Admin\AppData\Local\Temp\11D8.tmp"98⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\1265.tmp"C:\Users\Admin\AppData\Local\Temp\1265.tmp"99⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\12E2.tmp"C:\Users\Admin\AppData\Local\Temp\12E2.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\134F.tmp"C:\Users\Admin\AppData\Local\Temp\134F.tmp"101⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\13CC.tmp"C:\Users\Admin\AppData\Local\Temp\13CC.tmp"102⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\1459.tmp"C:\Users\Admin\AppData\Local\Temp\1459.tmp"103⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\14D6.tmp"C:\Users\Admin\AppData\Local\Temp\14D6.tmp"104⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\1543.tmp"C:\Users\Admin\AppData\Local\Temp\1543.tmp"105⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\15C0.tmp"C:\Users\Admin\AppData\Local\Temp\15C0.tmp"106⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\163D.tmp"C:\Users\Admin\AppData\Local\Temp\163D.tmp"107⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\169B.tmp"C:\Users\Admin\AppData\Local\Temp\169B.tmp"108⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\1737.tmp"C:\Users\Admin\AppData\Local\Temp\1737.tmp"109⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\17A5.tmp"C:\Users\Admin\AppData\Local\Temp\17A5.tmp"110⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"111⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"112⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"113⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"114⤵PID:5456
-
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"115⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"116⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"117⤵PID:120
-
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"118⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\1C19.tmp"C:\Users\Admin\AppData\Local\Temp\1C19.tmp"119⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\1C96.tmp"C:\Users\Admin\AppData\Local\Temp\1C96.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\1D04.tmp"C:\Users\Admin\AppData\Local\Temp\1D04.tmp"121⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\1D90.tmp"C:\Users\Admin\AppData\Local\Temp\1D90.tmp"122⤵PID:912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-