Analysis
- max time kernel
132s - max time network
86s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 10:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_cd44eb9e319027ca7a19c9d4f79654bb_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_cd44eb9e319027ca7a19c9d4f79654bb_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-07-11_cd44eb9e319027ca7a19c9d4f79654bb_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260711-mk249sh14t
- SHA256 631ff1cfa882230f36aa52c40bcf930552af272f8d5acbb2dcca6462cc90e00e
- MD5 cd44eb9e319027ca7a19c9d4f79654bb
- SHA1 e90e0b4b2de967c2d4a568d81f45c6cc44220d64
- SHA512 ba7a83301cff6c5dab42c8d6bd2b530d462a7e85f57761758f5f9ca8b22ce057468d9dea56742c14122b1d44fffc093f1aebc658699bcaa38256ce4ed6213fcc
- SSDEEP 12288:wU5rCOTeiD9dY44+JFoxvvC05xU4JlNZ+3/v+I9hUG2VA:wUQOJD9dY44tvqaxFNGEA
- TLSH T19FE4D02177D8C632E5F7037859B5E6614DBEBD22A722D6CF2F8412AE4971BC08631723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 464 D1AE.tmp 2944 D2B7.tmp 1660 D567.tmp 2092 D5E4.tmp 2624 D845.tmp 2400 D930.tmp 1580 DA49.tmp 4724 DB72.tmp 4372 DC6C.tmp 4268 DD95.tmp 5284 DEBE.tmp 692 DFF6.tmp 5040 E0E0.tmp 2128 E209.tmp 1900 E313.tmp 1412 E43C.tmp 5744 E555.tmp 1420 E65F.tmp 2688 E7A7.tmp 4744 E8A1.tmp 4448 E9BA.tmp 4516 EAB4.tmp 2928 EC2B.tmp 5960 ED64.tmp 1808 EE6D.tmp 3044 EF86.tmp 4912 F0DE.tmp 5728 F1F7.tmp 5396 F330.tmp 4112 F449.tmp 456 F553.tmp 4432 F64D.tmp 3316 F766.tmp 4616 F841.tmp 4992 F93B.tmp 2012 F9E7.tmp 4820 FAD1.tmp 4776 FB6D.tmp 200 FC19.tmp 2936 FCB5.tmp 4276 FD90.tmp 1068 FE2C.tmp 2828 FEF8.tmp 2180 FFB3.tmp 3700 6F.tmp 3376 169.tmp 6056 234.tmp 4336 30E.tmp 4576 3F9.tmp 1156 476.tmp 4920 502.tmp 5552 57F.tmp 5904 5FC.tmp 4932 66A.tmp 4248 716.tmp 2368 7C2.tmp 4256 85E.tmp 4452 8DB.tmp 5620 977.tmp 620 A13.tmp 5492 AA0.tmp 2212 B1D.tmp 420 B8A.tmp 5172 C07.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8142.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8692.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A322.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D718.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1190.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4236.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8619.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7878.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 329A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 639D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6483.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E313.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2102.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C778.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A53A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C804.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4160.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D274.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 125.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 128A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8955.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A440.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 416A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4960 wrote to memory of 464 4960 2026-07-11_cd44eb9e319027ca7a19c9d4f79654bb_elex_mafia_stealc_tofsee.exe 86 PID 464 wrote to memory of 2944 464 D1AE.tmp 87 PID 2944 wrote to memory of 1660 2944 D2B7.tmp 88 PID 1660 wrote to memory of 2092 1660 D567.tmp 89 PID 2092 wrote to memory of 2624 2092 D5E4.tmp 90 PID 2624 wrote to memory of 2400 2624 D845.tmp 91 PID 2400 wrote to memory of 1580 2400 D930.tmp 92 PID 1580 wrote to memory of 4724 1580 DA49.tmp 93 PID 4724 wrote to memory of 4372 4724 DB72.tmp 94 PID 4372 wrote to memory of 4268 4372 DC6C.tmp 95 PID 4268 wrote to memory of 5284 4268 DD95.tmp 96 PID 5284 wrote to memory of 692 5284 DEBE.tmp 97 PID 692 wrote to memory of 5040 692 DFF6.tmp 98 PID 5040 wrote to memory of 2128 5040 E0E0.tmp 99 PID 2128 wrote to memory of 1900 2128 E209.tmp 100 PID 1900 wrote to memory of 1412 1900 E313.tmp 101 PID 1412 wrote to memory of 5744 1412 E43C.tmp 102 PID 5744 wrote to memory of 1420 5744 E555.tmp 103 PID 1420 wrote to memory of 2688 1420 E65F.tmp 104 PID 2688 wrote to memory of 4744 2688 E7A7.tmp 105 PID 4744 wrote to memory of 4448 4744 E8A1.tmp 106 PID 4448 wrote to memory of 4516 4448 E9BA.tmp 107 PID 4516 wrote to memory of 2928 4516 EAB4.tmp 108 PID 2928 wrote to memory of 5960 2928 EC2B.tmp 109 PID 5960 wrote to memory of 1808 5960 ED64.tmp 110 PID 1808 wrote to memory of 3044 1808 EE6D.tmp 111 PID 3044 wrote to memory of 4912 3044 EF86.tmp 112 PID 4912 wrote to memory of 5728 4912 F0DE.tmp 113 PID 5728 wrote to memory of 5396 5728 F1F7.tmp 114 PID 5396 wrote to memory of 4112 5396 F330.tmp 115 PID 4112 wrote to memory of 456 4112 F449.tmp 116 PID 456 wrote to memory of 4432 456 F553.tmp 117 PID 4432 wrote to memory of 3316 4432 F64D.tmp 118 PID 3316 wrote to memory of 4616 3316 F766.tmp 119 PID 4616 wrote to memory of 4992 4616 F841.tmp 120 PID 4992 wrote to memory of 2012 4992 F93B.tmp 121 PID 2012 wrote to memory of 4820 2012 F9E7.tmp 122 PID 4820 wrote to memory of 4776 4820 FAD1.tmp 123 PID 4776 wrote to memory of 200 4776 FB6D.tmp 124 PID 200 wrote to memory of 2936 200 FC19.tmp 125 PID 2936 wrote to memory of 4276 2936 FCB5.tmp 126 PID 4276 wrote to memory of 1068 4276 FD90.tmp 127 PID 1068 wrote to memory of 2828 1068 FE2C.tmp 128 PID 2828 wrote to memory of 2180 2828 FEF8.tmp 129 PID 2180 wrote to memory of 3700 2180 FFB3.tmp 130 PID 3700 wrote to memory of 3376 3700 6F.tmp 131 PID 3376 wrote to memory of 6056 3376 169.tmp 132 PID 6056 wrote to memory of 4336 6056 234.tmp 133 PID 4336 wrote to memory of 4576 4336 30E.tmp 134 PID 4576 wrote to memory of 1156 4576 3F9.tmp 135 PID 1156 wrote to memory of 4920 1156 476.tmp 136 PID 4920 wrote to memory of 5552 4920 502.tmp 137 PID 5552 wrote to memory of 5904 5552 57F.tmp 138 PID 5904 wrote to memory of 4932 5904 5FC.tmp 139 PID 4932 wrote to memory of 4248 4932 66A.tmp 140 PID 4248 wrote to memory of 2368 4248 716.tmp 141 PID 2368 wrote to memory of 4256 2368 7C2.tmp 142 PID 4256 wrote to memory of 4452 4256 85E.tmp 143 PID 4452 wrote to memory of 5620 4452 8DB.tmp 144 PID 5620 wrote to memory of 620 5620 977.tmp 145 PID 620 wrote to memory of 5492 620 A13.tmp 146 PID 5492 wrote to memory of 2212 5492 AA0.tmp 147 PID 2212 wrote to memory of 420 2212 B1D.tmp 148 PID 420 wrote to memory of 5172 420 B8A.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_cd44eb9e319027ca7a19c9d4f79654bb_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_cd44eb9e319027ca7a19c9d4f79654bb_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\D1AE.tmp"C:\Users\Admin\AppData\Local\Temp\D1AE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\D2B7.tmp"C:\Users\Admin\AppData\Local\Temp\D2B7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\D567.tmp"C:\Users\Admin\AppData\Local\Temp\D567.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\D845.tmp"C:\Users\Admin\AppData\Local\Temp\D845.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\D930.tmp"C:\Users\Admin\AppData\Local\Temp\D930.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\DA49.tmp"C:\Users\Admin\AppData\Local\Temp\DA49.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\DB72.tmp"C:\Users\Admin\AppData\Local\Temp\DB72.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"C:\Users\Admin\AppData\Local\Temp\DC6C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\DD95.tmp"C:\Users\Admin\AppData\Local\Temp\DD95.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\DEBE.tmp"C:\Users\Admin\AppData\Local\Temp\DEBE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"C:\Users\Admin\AppData\Local\Temp\E0E0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\E209.tmp"C:\Users\Admin\AppData\Local\Temp\E209.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\E313.tmp"C:\Users\Admin\AppData\Local\Temp\E313.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\E43C.tmp"C:\Users\Admin\AppData\Local\Temp\E43C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\E555.tmp"C:\Users\Admin\AppData\Local\Temp\E555.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\E65F.tmp"C:\Users\Admin\AppData\Local\Temp\E65F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\E7A7.tmp"C:\Users\Admin\AppData\Local\Temp\E7A7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\E9BA.tmp"C:\Users\Admin\AppData\Local\Temp\E9BA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\EC2B.tmp"C:\Users\Admin\AppData\Local\Temp\EC2B.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\ED64.tmp"C:\Users\Admin\AppData\Local\Temp\ED64.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\EE6D.tmp"C:\Users\Admin\AppData\Local\Temp\EE6D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\EF86.tmp"C:\Users\Admin\AppData\Local\Temp\EF86.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\F0DE.tmp"C:\Users\Admin\AppData\Local\Temp\F0DE.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\F1F7.tmp"C:\Users\Admin\AppData\Local\Temp\F1F7.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\F330.tmp"C:\Users\Admin\AppData\Local\Temp\F330.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\F449.tmp"C:\Users\Admin\AppData\Local\Temp\F449.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\F553.tmp"C:\Users\Admin\AppData\Local\Temp\F553.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\F64D.tmp"C:\Users\Admin\AppData\Local\Temp\F64D.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\F766.tmp"C:\Users\Admin\AppData\Local\Temp\F766.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\F841.tmp"C:\Users\Admin\AppData\Local\Temp\F841.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\F93B.tmp"C:\Users\Admin\AppData\Local\Temp\F93B.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\F9E7.tmp"C:\Users\Admin\AppData\Local\Temp\F9E7.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\FAD1.tmp"C:\Users\Admin\AppData\Local\Temp\FAD1.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\FB6D.tmp"C:\Users\Admin\AppData\Local\Temp\FB6D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\FC19.tmp"C:\Users\Admin\AppData\Local\Temp\FC19.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\FCB5.tmp"C:\Users\Admin\AppData\Local\Temp\FCB5.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\FD90.tmp"C:\Users\Admin\AppData\Local\Temp\FD90.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\FE2C.tmp"C:\Users\Admin\AppData\Local\Temp\FE2C.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\6F.tmp"C:\Users\Admin\AppData\Local\Temp\6F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\169.tmp"C:\Users\Admin\AppData\Local\Temp\169.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\234.tmp"C:\Users\Admin\AppData\Local\Temp\234.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Users\Admin\AppData\Local\Temp\30E.tmp"C:\Users\Admin\AppData\Local\Temp\30E.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\3F9.tmp"C:\Users\Admin\AppData\Local\Temp\3F9.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\476.tmp"C:\Users\Admin\AppData\Local\Temp\476.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\502.tmp"C:\Users\Admin\AppData\Local\Temp\502.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\57F.tmp"C:\Users\Admin\AppData\Local\Temp\57F.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\5FC.tmp"C:\Users\Admin\AppData\Local\Temp\5FC.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\66A.tmp"C:\Users\Admin\AppData\Local\Temp\66A.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\716.tmp"C:\Users\Admin\AppData\Local\Temp\716.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\7C2.tmp"C:\Users\Admin\AppData\Local\Temp\7C2.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\85E.tmp"C:\Users\Admin\AppData\Local\Temp\85E.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\8DB.tmp"C:\Users\Admin\AppData\Local\Temp\8DB.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\977.tmp"C:\Users\Admin\AppData\Local\Temp\977.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Users\Admin\AppData\Local\Temp\A13.tmp"C:\Users\Admin\AppData\Local\Temp\A13.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\AA0.tmp"C:\Users\Admin\AppData\Local\Temp\AA0.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\B1D.tmp"C:\Users\Admin\AppData\Local\Temp\B1D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\B8A.tmp"C:\Users\Admin\AppData\Local\Temp\B8A.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:420 -
C:\Users\Admin\AppData\Local\Temp\C07.tmp"C:\Users\Admin\AppData\Local\Temp\C07.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\C84.tmp"C:\Users\Admin\AppData\Local\Temp\C84.tmp"66⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\D21.tmp"C:\Users\Admin\AppData\Local\Temp\D21.tmp"67⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\DAD.tmp"C:\Users\Admin\AppData\Local\Temp\DAD.tmp"68⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\E2A.tmp"C:\Users\Admin\AppData\Local\Temp\E2A.tmp"69⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\EA7.tmp"C:\Users\Admin\AppData\Local\Temp\EA7.tmp"70⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\F24.tmp"C:\Users\Admin\AppData\Local\Temp\F24.tmp"71⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\FA1.tmp"C:\Users\Admin\AppData\Local\Temp\FA1.tmp"72⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\101E.tmp"C:\Users\Admin\AppData\Local\Temp\101E.tmp"73⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\10BA.tmp"C:\Users\Admin\AppData\Local\Temp\10BA.tmp"74⤵PID:6028
-
C:\Users\Admin\AppData\Local\Temp\1147.tmp"C:\Users\Admin\AppData\Local\Temp\1147.tmp"75⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\11B4.tmp"C:\Users\Admin\AppData\Local\Temp\11B4.tmp"76⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\1222.tmp"C:\Users\Admin\AppData\Local\Temp\1222.tmp"77⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\12BE.tmp"C:\Users\Admin\AppData\Local\Temp\12BE.tmp"78⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\134B.tmp"C:\Users\Admin\AppData\Local\Temp\134B.tmp"79⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\13C8.tmp"C:\Users\Admin\AppData\Local\Temp\13C8.tmp"80⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\1454.tmp"C:\Users\Admin\AppData\Local\Temp\1454.tmp"81⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\14D1.tmp"C:\Users\Admin\AppData\Local\Temp\14D1.tmp"82⤵PID:6036
-
C:\Users\Admin\AppData\Local\Temp\154E.tmp"C:\Users\Admin\AppData\Local\Temp\154E.tmp"83⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\15CB.tmp"C:\Users\Admin\AppData\Local\Temp\15CB.tmp"84⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\1658.tmp"C:\Users\Admin\AppData\Local\Temp\1658.tmp"85⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\16E5.tmp"C:\Users\Admin\AppData\Local\Temp\16E5.tmp"86⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\1752.tmp"C:\Users\Admin\AppData\Local\Temp\1752.tmp"87⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\17CF.tmp"C:\Users\Admin\AppData\Local\Temp\17CF.tmp"88⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\183C.tmp"C:\Users\Admin\AppData\Local\Temp\183C.tmp"89⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\18E8.tmp"C:\Users\Admin\AppData\Local\Temp\18E8.tmp"90⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\1994.tmp"C:\Users\Admin\AppData\Local\Temp\1994.tmp"91⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\1A11.tmp"C:\Users\Admin\AppData\Local\Temp\1A11.tmp"92⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\1A7E.tmp"C:\Users\Admin\AppData\Local\Temp\1A7E.tmp"93⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\1AFB.tmp"C:\Users\Admin\AppData\Local\Temp\1AFB.tmp"94⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\1B69.tmp"C:\Users\Admin\AppData\Local\Temp\1B69.tmp"95⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"96⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\1C63.tmp"C:\Users\Admin\AppData\Local\Temp\1C63.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"98⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"99⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\1E09.tmp"C:\Users\Admin\AppData\Local\Temp\1E09.tmp"100⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\1E95.tmp"C:\Users\Admin\AppData\Local\Temp\1E95.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\1F32.tmp"C:\Users\Admin\AppData\Local\Temp\1F32.tmp"102⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\1FBE.tmp"C:\Users\Admin\AppData\Local\Temp\1FBE.tmp"103⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\206A.tmp"C:\Users\Admin\AppData\Local\Temp\206A.tmp"104⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\2106.tmp"C:\Users\Admin\AppData\Local\Temp\2106.tmp"105⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\21A3.tmp"C:\Users\Admin\AppData\Local\Temp\21A3.tmp"106⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\222F.tmp"C:\Users\Admin\AppData\Local\Temp\222F.tmp"107⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\229D.tmp"C:\Users\Admin\AppData\Local\Temp\229D.tmp"108⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\2348.tmp"C:\Users\Admin\AppData\Local\Temp\2348.tmp"109⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\23C5.tmp"C:\Users\Admin\AppData\Local\Temp\23C5.tmp"110⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"111⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"112⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"113⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\2608.tmp"C:\Users\Admin\AppData\Local\Temp\2608.tmp"114⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\2685.tmp"C:\Users\Admin\AppData\Local\Temp\2685.tmp"115⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"116⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\27DC.tmp"C:\Users\Admin\AppData\Local\Temp\27DC.tmp"117⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\2869.tmp"C:\Users\Admin\AppData\Local\Temp\2869.tmp"118⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\2905.tmp"C:\Users\Admin\AppData\Local\Temp\2905.tmp"119⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\2982.tmp"C:\Users\Admin\AppData\Local\Temp\2982.tmp"120⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\29FF.tmp"C:\Users\Admin\AppData\Local\Temp\29FF.tmp"121⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\2A8C.tmp"C:\Users\Admin\AppData\Local\Temp\2A8C.tmp"122⤵PID:3720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-