Analysis
- max time kernel
119s - max time network
111s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 14:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_0467e819aca3079fedc479e4b66e610c_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_0467e819aca3079fedc479e4b66e610c_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-12_0467e819aca3079fedc479e4b66e610c_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260712-r2fd2sdy5v
- SHA256 71ef9207609a6c5f7dcb82dfed1b3f1718fb30d5fffa075da62effa996367ef6
- MD5 0467e819aca3079fedc479e4b66e610c
- SHA1 884ec3849af0affe8bf7b3a400c92b22f934df1b
- SHA512 f35082f242a5a393ec843e5ec7c71be1fac0b591f1707acad3b95064a0e5e4ae3674c837197b3b8bcb4ddb769ed469efaacf1d5c0378f2508a064d14c463c7bb
- SSDEEP 12288:NU5rCOTeijqt8VYRrG7e3UZOyC6wTZwlH:NUQOJjqtjCq3yVCVTSlH
- TLSH T1E9B4F125B685C432E2D201710AE6DBA16A3B7C35872958CB3B94637E2FB53E0E375343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1748 DF5A.tmp 4340 DFF6.tmp 1360 E0B2.tmp 3372 E18C.tmp 1928 E229.tmp 4780 E2A6.tmp 3316 E40D.tmp 1544 E565.tmp 1668 E630.tmp 3352 E6DC.tmp 4236 E7D6.tmp 3548 E862.tmp 5052 E8DF.tmp 2572 E99B.tmp 4952 EA47.tmp 2684 EAE3.tmp 696 EB9E.tmp 1272 EC5A.tmp 3212 ECC7.tmp 5508 ED54.tmp 2960 EDF0.tmp 2196 EEDB.tmp 1128 EFA6.tmp 4216 F032.tmp 3192 F0DE.tmp 2088 F19A.tmp 2712 F236.tmp 1460 F2C3.tmp 5988 F36E.tmp 4800 F3EB.tmp 4884 F488.tmp 2276 F543.tmp 2736 F5FF.tmp 2984 F6AB.tmp 3920 F737.tmp 5468 F7C4.tmp 2460 F831.tmp 3148 F8CD.tmp 2752 F979.tmp 4760 FA16.tmp 2444 FAA2.tmp 5736 FB5E.tmp 2400 FBDB.tmp 3744 FC48.tmp 1052 FCE4.tmp 3224 FD81.tmp 3344 FDFE.tmp 924 FE8A.tmp 1088 FF26.tmp 1636 FF94.tmp 5188 1.tmp 1424 8E.tmp 3200 10B.tmp 4832 197.tmp 5296 243.tmp 2876 2E0.tmp 5464 36C.tmp 2312 418.tmp 2320 4A5.tmp 5936 522.tmp 4896 5BE.tmp 4836 64B.tmp 4536 6E7.tmp 1224 773.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F52F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2670.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5204.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 530E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 348E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A673.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A336.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F732.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4718.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 880D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3092.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 655E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F831.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 522.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 154.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2702.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 300A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1932.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 272C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 135A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 444E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E456.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 488F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BCB.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3064 wrote to memory of 1748 3064 2026-07-12_0467e819aca3079fedc479e4b66e610c_elex_mafia_stealc_tofsee.exe 86 PID 1748 wrote to memory of 4340 1748 DF5A.tmp 87 PID 4340 wrote to memory of 1360 4340 DFF6.tmp 88 PID 1360 wrote to memory of 3372 1360 E0B2.tmp 89 PID 3372 wrote to memory of 1928 3372 E18C.tmp 90 PID 1928 wrote to memory of 4780 1928 E229.tmp 91 PID 4780 wrote to memory of 3316 4780 E2A6.tmp 92 PID 3316 wrote to memory of 1544 3316 E40D.tmp 93 PID 1544 wrote to memory of 1668 1544 E565.tmp 94 PID 1668 wrote to memory of 3352 1668 E630.tmp 95 PID 3352 wrote to memory of 4236 3352 E6DC.tmp 96 PID 4236 wrote to memory of 3548 4236 E7D6.tmp 97 PID 3548 wrote to memory of 5052 3548 E862.tmp 98 PID 5052 wrote to memory of 2572 5052 E8DF.tmp 99 PID 2572 wrote to memory of 4952 2572 E99B.tmp 100 PID 4952 wrote to memory of 2684 4952 EA47.tmp 101 PID 2684 wrote to memory of 696 2684 EAE3.tmp 102 PID 696 wrote to memory of 1272 696 EB9E.tmp 103 PID 1272 wrote to memory of 3212 1272 EC5A.tmp 104 PID 3212 wrote to memory of 5508 3212 ECC7.tmp 105 PID 5508 wrote to memory of 2960 5508 ED54.tmp 106 PID 2960 wrote to memory of 2196 2960 EDF0.tmp 107 PID 2196 wrote to memory of 1128 2196 EEDB.tmp 108 PID 1128 wrote to memory of 4216 1128 EFA6.tmp 109 PID 4216 wrote to memory of 3192 4216 F032.tmp 110 PID 3192 wrote to memory of 2088 3192 F0DE.tmp 111 PID 2088 wrote to memory of 2712 2088 F19A.tmp 112 PID 2712 wrote to memory of 1460 2712 F236.tmp 113 PID 1460 wrote to memory of 5988 1460 F2C3.tmp 114 PID 5988 wrote to memory of 4800 5988 F36E.tmp 115 PID 4800 wrote to memory of 4884 4800 F3EB.tmp 116 PID 4884 wrote to memory of 2276 4884 F488.tmp 117 PID 2276 wrote to memory of 2736 2276 F543.tmp 118 PID 2736 wrote to memory of 2984 2736 F5FF.tmp 119 PID 2984 wrote to memory of 3920 2984 F6AB.tmp 120 PID 3920 wrote to memory of 5468 3920 F737.tmp 121 PID 5468 wrote to memory of 2460 5468 F7C4.tmp 122 PID 2460 wrote to memory of 3148 2460 F831.tmp 123 PID 3148 wrote to memory of 2752 3148 F8CD.tmp 124 PID 2752 wrote to memory of 4760 2752 F979.tmp 125 PID 4760 wrote to memory of 2444 4760 FA16.tmp 126 PID 2444 wrote to memory of 5736 2444 FAA2.tmp 127 PID 5736 wrote to memory of 2400 5736 FB5E.tmp 128 PID 2400 wrote to memory of 3744 2400 FBDB.tmp 129 PID 3744 wrote to memory of 1052 3744 FC48.tmp 130 PID 1052 wrote to memory of 3224 1052 FCE4.tmp 131 PID 3224 wrote to memory of 3344 3224 FD81.tmp 132 PID 3344 wrote to memory of 924 3344 FDFE.tmp 133 PID 924 wrote to memory of 1088 924 FE8A.tmp 134 PID 1088 wrote to memory of 1636 1088 FF26.tmp 135 PID 1636 wrote to memory of 5188 1636 FF94.tmp 136 PID 5188 wrote to memory of 1424 5188 1.tmp 137 PID 1424 wrote to memory of 3200 1424 8E.tmp 138 PID 3200 wrote to memory of 4832 3200 10B.tmp 139 PID 4832 wrote to memory of 5296 4832 197.tmp 140 PID 5296 wrote to memory of 2876 5296 243.tmp 141 PID 2876 wrote to memory of 5464 2876 2E0.tmp 142 PID 5464 wrote to memory of 2312 5464 36C.tmp 143 PID 2312 wrote to memory of 2320 2312 418.tmp 144 PID 2320 wrote to memory of 5936 2320 4A5.tmp 145 PID 5936 wrote to memory of 4896 5936 522.tmp 146 PID 4896 wrote to memory of 4836 4896 5BE.tmp 147 PID 4836 wrote to memory of 4536 4836 64B.tmp 148 PID 4536 wrote to memory of 1224 4536 6E7.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_0467e819aca3079fedc479e4b66e610c_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_0467e819aca3079fedc479e4b66e610c_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"C:\Users\Admin\AppData\Local\Temp\DF5A.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\E0B2.tmp"C:\Users\Admin\AppData\Local\Temp\E0B2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\E18C.tmp"C:\Users\Admin\AppData\Local\Temp\E18C.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\E229.tmp"C:\Users\Admin\AppData\Local\Temp\E229.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\E2A6.tmp"C:\Users\Admin\AppData\Local\Temp\E2A6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\E40D.tmp"C:\Users\Admin\AppData\Local\Temp\E40D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\E565.tmp"C:\Users\Admin\AppData\Local\Temp\E565.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\E630.tmp"C:\Users\Admin\AppData\Local\Temp\E630.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\E6DC.tmp"C:\Users\Admin\AppData\Local\Temp\E6DC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\E7D6.tmp"C:\Users\Admin\AppData\Local\Temp\E7D6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\E862.tmp"C:\Users\Admin\AppData\Local\Temp\E862.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\E8DF.tmp"C:\Users\Admin\AppData\Local\Temp\E8DF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\E99B.tmp"C:\Users\Admin\AppData\Local\Temp\E99B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\EA47.tmp"C:\Users\Admin\AppData\Local\Temp\EA47.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\EC5A.tmp"C:\Users\Admin\AppData\Local\Temp\EC5A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\ECC7.tmp"C:\Users\Admin\AppData\Local\Temp\ECC7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\ED54.tmp"C:\Users\Admin\AppData\Local\Temp\ED54.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\EEDB.tmp"C:\Users\Admin\AppData\Local\Temp\EEDB.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\EFA6.tmp"C:\Users\Admin\AppData\Local\Temp\EFA6.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\F032.tmp"C:\Users\Admin\AppData\Local\Temp\F032.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\F0DE.tmp"C:\Users\Admin\AppData\Local\Temp\F0DE.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\F19A.tmp"C:\Users\Admin\AppData\Local\Temp\F19A.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\F236.tmp"C:\Users\Admin\AppData\Local\Temp\F236.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\F2C3.tmp"C:\Users\Admin\AppData\Local\Temp\F2C3.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\F36E.tmp"C:\Users\Admin\AppData\Local\Temp\F36E.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Users\Admin\AppData\Local\Temp\F3EB.tmp"C:\Users\Admin\AppData\Local\Temp\F3EB.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\F488.tmp"C:\Users\Admin\AppData\Local\Temp\F488.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\F543.tmp"C:\Users\Admin\AppData\Local\Temp\F543.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"C:\Users\Admin\AppData\Local\Temp\F5FF.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\F737.tmp"C:\Users\Admin\AppData\Local\Temp\F737.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\F7C4.tmp"C:\Users\Admin\AppData\Local\Temp\F7C4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Users\Admin\AppData\Local\Temp\F831.tmp"C:\Users\Admin\AppData\Local\Temp\F831.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\F8CD.tmp"C:\Users\Admin\AppData\Local\Temp\F8CD.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\F979.tmp"C:\Users\Admin\AppData\Local\Temp\F979.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\FA16.tmp"C:\Users\Admin\AppData\Local\Temp\FA16.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\FB5E.tmp"C:\Users\Admin\AppData\Local\Temp\FB5E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\FBDB.tmp"C:\Users\Admin\AppData\Local\Temp\FBDB.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\FC48.tmp"C:\Users\Admin\AppData\Local\Temp\FC48.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\FCE4.tmp"C:\Users\Admin\AppData\Local\Temp\FCE4.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\FD81.tmp"C:\Users\Admin\AppData\Local\Temp\FD81.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"C:\Users\Admin\AppData\Local\Temp\FE8A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\FF26.tmp"C:\Users\Admin\AppData\Local\Temp\FF26.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\FF94.tmp"C:\Users\Admin\AppData\Local\Temp\FF94.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\1.tmp"C:\Users\Admin\AppData\Local\Temp\1.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\8E.tmp"C:\Users\Admin\AppData\Local\Temp\8E.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\10B.tmp"C:\Users\Admin\AppData\Local\Temp\10B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\197.tmp"C:\Users\Admin\AppData\Local\Temp\197.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\243.tmp"C:\Users\Admin\AppData\Local\Temp\243.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\2E0.tmp"C:\Users\Admin\AppData\Local\Temp\2E0.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\36C.tmp"C:\Users\Admin\AppData\Local\Temp\36C.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\418.tmp"C:\Users\Admin\AppData\Local\Temp\418.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\4A5.tmp"C:\Users\Admin\AppData\Local\Temp\4A5.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\522.tmp"C:\Users\Admin\AppData\Local\Temp\522.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\5BE.tmp"C:\Users\Admin\AppData\Local\Temp\5BE.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\64B.tmp"C:\Users\Admin\AppData\Local\Temp\64B.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\6E7.tmp"C:\Users\Admin\AppData\Local\Temp\6E7.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\773.tmp"C:\Users\Admin\AppData\Local\Temp\773.tmp"65⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\7F0.tmp"C:\Users\Admin\AppData\Local\Temp\7F0.tmp"66⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\85E.tmp"C:\Users\Admin\AppData\Local\Temp\85E.tmp"67⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\8EA.tmp"C:\Users\Admin\AppData\Local\Temp\8EA.tmp"68⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\977.tmp"C:\Users\Admin\AppData\Local\Temp\977.tmp"69⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\A04.tmp"C:\Users\Admin\AppData\Local\Temp\A04.tmp"70⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\A81.tmp"C:\Users\Admin\AppData\Local\Temp\A81.tmp"71⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\AEE.tmp"C:\Users\Admin\AppData\Local\Temp\AEE.tmp"72⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\B8A.tmp"C:\Users\Admin\AppData\Local\Temp\B8A.tmp"73⤵PID:5616
-
C:\Users\Admin\AppData\Local\Temp\C17.tmp"C:\Users\Admin\AppData\Local\Temp\C17.tmp"74⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\CB3.tmp"C:\Users\Admin\AppData\Local\Temp\CB3.tmp"75⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\D30.tmp"C:\Users\Admin\AppData\Local\Temp\D30.tmp"76⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\DBD.tmp"C:\Users\Admin\AppData\Local\Temp\DBD.tmp"77⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\E49.tmp"C:\Users\Admin\AppData\Local\Temp\E49.tmp"78⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\EC6.tmp"C:\Users\Admin\AppData\Local\Temp\EC6.tmp"79⤵PID:5872
-
C:\Users\Admin\AppData\Local\Temp\F72.tmp"C:\Users\Admin\AppData\Local\Temp\F72.tmp"80⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\FFF.tmp"C:\Users\Admin\AppData\Local\Temp\FFF.tmp"81⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\107C.tmp"C:\Users\Admin\AppData\Local\Temp\107C.tmp"82⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\1118.tmp"C:\Users\Admin\AppData\Local\Temp\1118.tmp"83⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\11A5.tmp"C:\Users\Admin\AppData\Local\Temp\11A5.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\1241.tmp"C:\Users\Admin\AppData\Local\Temp\1241.tmp"85⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\12DD.tmp"C:\Users\Admin\AppData\Local\Temp\12DD.tmp"86⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\135A.tmp"C:\Users\Admin\AppData\Local\Temp\135A.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\13C8.tmp"C:\Users\Admin\AppData\Local\Temp\13C8.tmp"88⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\1454.tmp"C:\Users\Admin\AppData\Local\Temp\1454.tmp"89⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\1510.tmp"C:\Users\Admin\AppData\Local\Temp\1510.tmp"90⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\15BC.tmp"C:\Users\Admin\AppData\Local\Temp\15BC.tmp"91⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\1658.tmp"C:\Users\Admin\AppData\Local\Temp\1658.tmp"92⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\16D5.tmp"C:\Users\Admin\AppData\Local\Temp\16D5.tmp"93⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\1752.tmp"C:\Users\Admin\AppData\Local\Temp\1752.tmp"94⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\17DF.tmp"C:\Users\Admin\AppData\Local\Temp\17DF.tmp"95⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\185C.tmp"C:\Users\Admin\AppData\Local\Temp\185C.tmp"96⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\18D9.tmp"C:\Users\Admin\AppData\Local\Temp\18D9.tmp"97⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\1956.tmp"C:\Users\Admin\AppData\Local\Temp\1956.tmp"98⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\1A11.tmp"C:\Users\Admin\AppData\Local\Temp\1A11.tmp"99⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\1AAD.tmp"C:\Users\Admin\AppData\Local\Temp\1AAD.tmp"100⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\1B3A.tmp"C:\Users\Admin\AppData\Local\Temp\1B3A.tmp"101⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"102⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\1C53.tmp"C:\Users\Admin\AppData\Local\Temp\1C53.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\1CFF.tmp"C:\Users\Admin\AppData\Local\Temp\1CFF.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:928 -
C:\Users\Admin\AppData\Local\Temp\1D8C.tmp"C:\Users\Admin\AppData\Local\Temp\1D8C.tmp"105⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\1E18.tmp"C:\Users\Admin\AppData\Local\Temp\1E18.tmp"106⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\1E86.tmp"C:\Users\Admin\AppData\Local\Temp\1E86.tmp"107⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\1F03.tmp"C:\Users\Admin\AppData\Local\Temp\1F03.tmp"108⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\1F80.tmp"C:\Users\Admin\AppData\Local\Temp\1F80.tmp"109⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\1FFD.tmp"C:\Users\Admin\AppData\Local\Temp\1FFD.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\2089.tmp"C:\Users\Admin\AppData\Local\Temp\2089.tmp"111⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\2126.tmp"C:\Users\Admin\AppData\Local\Temp\2126.tmp"112⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\2193.tmp"C:\Users\Admin\AppData\Local\Temp\2193.tmp"113⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\223F.tmp"C:\Users\Admin\AppData\Local\Temp\223F.tmp"114⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\22AC.tmp"C:\Users\Admin\AppData\Local\Temp\22AC.tmp"115⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\231A.tmp"C:\Users\Admin\AppData\Local\Temp\231A.tmp"116⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\2387.tmp"C:\Users\Admin\AppData\Local\Temp\2387.tmp"117⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"118⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"119⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"120⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"121⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\25F8.tmp"C:\Users\Admin\AppData\Local\Temp\25F8.tmp"122⤵PID:4576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-