Analysis
- max time kernel
123s - max time network
110s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 03:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-14_a2707eaa0149a602b51ab726c333931c_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_a2707eaa0149a602b51ab726c333931c_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-14_a2707eaa0149a602b51ab726c333931c_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260714-dxltdads9j
- SHA256 7dd3f5bffebe8f5cba98cf450845c03d809156563c86c7e3b0fd9715ca388a13
- MD5 a2707eaa0149a602b51ab726c333931c
- SHA1 cafe9741b753ff15a5eee525861948f81500892f
- SHA512 82750ff4e030fd7b98bac74f7ce33a5078dba2ff0e8d448378bfa8bfc2e173727bc854778a513d0b6edfb418b520eefe2c3732bf3f2c96f74faf0bb20a7b984f
- SSDEEP 12288:wU5rCOTeiDT6Oi+jC3ANe7M6ut7mCKiybzQlftNZ+3/v+I9hUG2VA:wUQOJDT7iGC3ANettiyb8zNGEA
- TLSH T116E4D02177D88532E5F7037859B5E6604D7EBD36A722D6CF2F8052AE19B1BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1964 D9FB.tmp 4836 DB04.tmp 5832 DC4D.tmp 4668 DD37.tmp 3156 DDC4.tmp 5380 DE41.tmp 1772 DEFC.tmp 3388 DF69.tmp 5376 DFD7.tmp 3460 E1BB.tmp 4056 E286.tmp 2360 E3AF.tmp 4984 E4B9.tmp 1064 E594.tmp 4648 E67E.tmp 5212 E778.tmp 2104 E843.tmp 4268 E92D.tmp 5964 EA37.tmp 5416 EB12.tmp 2320 EC1B.tmp 1080 ECE7.tmp 6092 EDF0.tmp 5908 EF19.tmp 1328 EFD5.tmp 568 F0DE.tmp 1972 F207.tmp 5916 F340.tmp 4548 F42A.tmp 1512 F514.tmp 2260 F5EF.tmp 3756 F6CA.tmp 5680 F7E3.tmp 3028 F8BE.tmp 2572 F94A.tmp 4436 F9E7.tmp 5188 FAA2.tmp 4184 FB9C.tmp 5364 FC77.tmp 6076 FD04.tmp 2484 FDAF.tmp 1312 FE5B.tmp 5640 FED8.tmp 1016 FF65.tmp 2988 30.tmp 956 EC.tmp 5996 1C6.tmp 4312 2B1.tmp 5816 36C.tmp 4964 3E9.tmp 4052 485.tmp 3416 522.tmp 5292 59F.tmp 4568 62B.tmp 1792 6A8.tmp 2600 735.tmp 3516 7B2.tmp 5860 83F.tmp 4672 8DB.tmp 3172 948.tmp 5324 9C5.tmp 1356 A33.tmp 4136 AA0.tmp 2576 B1D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7924.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 635A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B98D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 275B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3351.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 503F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 762B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 462D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 495A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8624.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6619.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 122D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 878C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8176.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3862.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B245.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A516.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E437.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 477A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 849.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B33F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A56.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1964 2012 2026-07-14_a2707eaa0149a602b51ab726c333931c_elex_mafia_stealc_tofsee.exe 87 PID 1964 wrote to memory of 4836 1964 D9FB.tmp 88 PID 4836 wrote to memory of 5832 4836 DB04.tmp 89 PID 5832 wrote to memory of 4668 5832 DC4D.tmp 90 PID 4668 wrote to memory of 3156 4668 DD37.tmp 91 PID 3156 wrote to memory of 5380 3156 DDC4.tmp 92 PID 5380 wrote to memory of 1772 5380 DE41.tmp 93 PID 1772 wrote to memory of 3388 1772 DEFC.tmp 94 PID 3388 wrote to memory of 5376 3388 DF69.tmp 95 PID 5376 wrote to memory of 3460 5376 DFD7.tmp 96 PID 3460 wrote to memory of 4056 3460 E1BB.tmp 97 PID 4056 wrote to memory of 2360 4056 E286.tmp 98 PID 2360 wrote to memory of 4984 2360 E3AF.tmp 99 PID 4984 wrote to memory of 1064 4984 E4B9.tmp 100 PID 1064 wrote to memory of 4648 1064 E594.tmp 101 PID 4648 wrote to memory of 5212 4648 E67E.tmp 102 PID 5212 wrote to memory of 2104 5212 E778.tmp 103 PID 2104 wrote to memory of 4268 2104 E843.tmp 104 PID 4268 wrote to memory of 5964 4268 E92D.tmp 105 PID 5964 wrote to memory of 5416 5964 EA37.tmp 106 PID 5416 wrote to memory of 2320 5416 EB12.tmp 107 PID 2320 wrote to memory of 1080 2320 EC1B.tmp 108 PID 1080 wrote to memory of 6092 1080 ECE7.tmp 109 PID 6092 wrote to memory of 5908 6092 EDF0.tmp 110 PID 5908 wrote to memory of 1328 5908 EF19.tmp 111 PID 1328 wrote to memory of 568 1328 EFD5.tmp 112 PID 568 wrote to memory of 1972 568 F0DE.tmp 113 PID 1972 wrote to memory of 5916 1972 F207.tmp 114 PID 5916 wrote to memory of 4548 5916 F340.tmp 115 PID 4548 wrote to memory of 1512 4548 F42A.tmp 116 PID 1512 wrote to memory of 2260 1512 F514.tmp 117 PID 2260 wrote to memory of 3756 2260 F5EF.tmp 118 PID 3756 wrote to memory of 5680 3756 F6CA.tmp 119 PID 5680 wrote to memory of 3028 5680 F7E3.tmp 120 PID 3028 wrote to memory of 2572 3028 F8BE.tmp 121 PID 2572 wrote to memory of 4436 2572 F94A.tmp 122 PID 4436 wrote to memory of 5188 4436 F9E7.tmp 123 PID 5188 wrote to memory of 4184 5188 FAA2.tmp 124 PID 4184 wrote to memory of 5364 4184 FB9C.tmp 125 PID 5364 wrote to memory of 6076 5364 FC77.tmp 126 PID 6076 wrote to memory of 2484 6076 FD04.tmp 127 PID 2484 wrote to memory of 1312 2484 FDAF.tmp 128 PID 1312 wrote to memory of 5640 1312 FE5B.tmp 129 PID 5640 wrote to memory of 1016 5640 FED8.tmp 130 PID 1016 wrote to memory of 2988 1016 FF65.tmp 131 PID 2988 wrote to memory of 956 2988 30.tmp 132 PID 956 wrote to memory of 5996 956 EC.tmp 133 PID 5996 wrote to memory of 4312 5996 1C6.tmp 134 PID 4312 wrote to memory of 5816 4312 2B1.tmp 135 PID 5816 wrote to memory of 4964 5816 36C.tmp 136 PID 4964 wrote to memory of 4052 4964 3E9.tmp 137 PID 4052 wrote to memory of 3416 4052 485.tmp 138 PID 3416 wrote to memory of 5292 3416 522.tmp 139 PID 5292 wrote to memory of 4568 5292 59F.tmp 140 PID 4568 wrote to memory of 1792 4568 62B.tmp 141 PID 1792 wrote to memory of 2600 1792 6A8.tmp 142 PID 2600 wrote to memory of 3516 2600 735.tmp 143 PID 3516 wrote to memory of 5860 3516 7B2.tmp 144 PID 5860 wrote to memory of 4672 5860 83F.tmp 145 PID 4672 wrote to memory of 3172 4672 8DB.tmp 146 PID 3172 wrote to memory of 5324 3172 948.tmp 147 PID 5324 wrote to memory of 1356 5324 9C5.tmp 148 PID 1356 wrote to memory of 4136 1356 A33.tmp 149 PID 4136 wrote to memory of 2576 4136 AA0.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_a2707eaa0149a602b51ab726c333931c_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_a2707eaa0149a602b51ab726c333931c_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\D9FB.tmp"C:\Users\Admin\AppData\Local\Temp\D9FB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\DB04.tmp"C:\Users\Admin\AppData\Local\Temp\DB04.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"C:\Users\Admin\AppData\Local\Temp\DC4D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\DD37.tmp"C:\Users\Admin\AppData\Local\Temp\DD37.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\DDC4.tmp"C:\Users\Admin\AppData\Local\Temp\DDC4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\DE41.tmp"C:\Users\Admin\AppData\Local\Temp\DE41.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\DEFC.tmp"C:\Users\Admin\AppData\Local\Temp\DEFC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\DF69.tmp"C:\Users\Admin\AppData\Local\Temp\DF69.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\DFD7.tmp"C:\Users\Admin\AppData\Local\Temp\DFD7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\E286.tmp"C:\Users\Admin\AppData\Local\Temp\E286.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\E3AF.tmp"C:\Users\Admin\AppData\Local\Temp\E3AF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\E4B9.tmp"C:\Users\Admin\AppData\Local\Temp\E4B9.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\E594.tmp"C:\Users\Admin\AppData\Local\Temp\E594.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\E67E.tmp"C:\Users\Admin\AppData\Local\Temp\E67E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\E778.tmp"C:\Users\Admin\AppData\Local\Temp\E778.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\E843.tmp"C:\Users\Admin\AppData\Local\Temp\E843.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\E92D.tmp"C:\Users\Admin\AppData\Local\Temp\E92D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\EA37.tmp"C:\Users\Admin\AppData\Local\Temp\EA37.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Users\Admin\AppData\Local\Temp\EB12.tmp"C:\Users\Admin\AppData\Local\Temp\EB12.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"C:\Users\Admin\AppData\Local\Temp\EC1B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"C:\Users\Admin\AppData\Local\Temp\EDF0.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\EF19.tmp"C:\Users\Admin\AppData\Local\Temp\EF19.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5908 -
C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\F0DE.tmp"C:\Users\Admin\AppData\Local\Temp\F0DE.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\F207.tmp"C:\Users\Admin\AppData\Local\Temp\F207.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\F340.tmp"C:\Users\Admin\AppData\Local\Temp\F340.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\F42A.tmp"C:\Users\Admin\AppData\Local\Temp\F42A.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\F514.tmp"C:\Users\Admin\AppData\Local\Temp\F514.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\F5EF.tmp"C:\Users\Admin\AppData\Local\Temp\F5EF.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\F6CA.tmp"C:\Users\Admin\AppData\Local\Temp\F6CA.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\F7E3.tmp"C:\Users\Admin\AppData\Local\Temp\F7E3.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\F94A.tmp"C:\Users\Admin\AppData\Local\Temp\F94A.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\F9E7.tmp"C:\Users\Admin\AppData\Local\Temp\F9E7.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"C:\Users\Admin\AppData\Local\Temp\FAA2.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\FB9C.tmp"C:\Users\Admin\AppData\Local\Temp\FB9C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\FC77.tmp"C:\Users\Admin\AppData\Local\Temp\FC77.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\FD04.tmp"C:\Users\Admin\AppData\Local\Temp\FD04.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Users\Admin\AppData\Local\Temp\FDAF.tmp"C:\Users\Admin\AppData\Local\Temp\FDAF.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\FE5B.tmp"C:\Users\Admin\AppData\Local\Temp\FE5B.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\FED8.tmp"C:\Users\Admin\AppData\Local\Temp\FED8.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\FF65.tmp"C:\Users\Admin\AppData\Local\Temp\FF65.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\EC.tmp"C:\Users\Admin\AppData\Local\Temp\EC.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\1C6.tmp"C:\Users\Admin\AppData\Local\Temp\1C6.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5996 -
C:\Users\Admin\AppData\Local\Temp\2B1.tmp"C:\Users\Admin\AppData\Local\Temp\2B1.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\36C.tmp"C:\Users\Admin\AppData\Local\Temp\36C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\3E9.tmp"C:\Users\Admin\AppData\Local\Temp\3E9.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\485.tmp"C:\Users\Admin\AppData\Local\Temp\485.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\522.tmp"C:\Users\Admin\AppData\Local\Temp\522.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\59F.tmp"C:\Users\Admin\AppData\Local\Temp\59F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\62B.tmp"C:\Users\Admin\AppData\Local\Temp\62B.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\6A8.tmp"C:\Users\Admin\AppData\Local\Temp\6A8.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\735.tmp"C:\Users\Admin\AppData\Local\Temp\735.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\7B2.tmp"C:\Users\Admin\AppData\Local\Temp\7B2.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\83F.tmp"C:\Users\Admin\AppData\Local\Temp\83F.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\8DB.tmp"C:\Users\Admin\AppData\Local\Temp\8DB.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\948.tmp"C:\Users\Admin\AppData\Local\Temp\948.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\9C5.tmp"C:\Users\Admin\AppData\Local\Temp\9C5.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\A33.tmp"C:\Users\Admin\AppData\Local\Temp\A33.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\AA0.tmp"C:\Users\Admin\AppData\Local\Temp\AA0.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\B1D.tmp"C:\Users\Admin\AppData\Local\Temp\B1D.tmp"65⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\B8A.tmp"C:\Users\Admin\AppData\Local\Temp\B8A.tmp"66⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\C07.tmp"C:\Users\Admin\AppData\Local\Temp\C07.tmp"67⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\C84.tmp"C:\Users\Admin\AppData\Local\Temp\C84.tmp"68⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\D11.tmp"C:\Users\Admin\AppData\Local\Temp\D11.tmp"69⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\D8E.tmp"C:\Users\Admin\AppData\Local\Temp\D8E.tmp"70⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\E2A.tmp"C:\Users\Admin\AppData\Local\Temp\E2A.tmp"71⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\E98.tmp"C:\Users\Admin\AppData\Local\Temp\E98.tmp"72⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\F15.tmp"C:\Users\Admin\AppData\Local\Temp\F15.tmp"73⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\FB1.tmp"C:\Users\Admin\AppData\Local\Temp\FB1.tmp"74⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\103D.tmp"C:\Users\Admin\AppData\Local\Temp\103D.tmp"75⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\10CA.tmp"C:\Users\Admin\AppData\Local\Temp\10CA.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\1147.tmp"C:\Users\Admin\AppData\Local\Temp\1147.tmp"77⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\11C4.tmp"C:\Users\Admin\AppData\Local\Temp\11C4.tmp"78⤵PID:5568
-
C:\Users\Admin\AppData\Local\Temp\1241.tmp"C:\Users\Admin\AppData\Local\Temp\1241.tmp"79⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\12AE.tmp"C:\Users\Admin\AppData\Local\Temp\12AE.tmp"80⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\131C.tmp"C:\Users\Admin\AppData\Local\Temp\131C.tmp"81⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\1389.tmp"C:\Users\Admin\AppData\Local\Temp\1389.tmp"82⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\1416.tmp"C:\Users\Admin\AppData\Local\Temp\1416.tmp"83⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\1493.tmp"C:\Users\Admin\AppData\Local\Temp\1493.tmp"84⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\1510.tmp"C:\Users\Admin\AppData\Local\Temp\1510.tmp"85⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\157D.tmp"C:\Users\Admin\AppData\Local\Temp\157D.tmp"86⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\15EB.tmp"C:\Users\Admin\AppData\Local\Temp\15EB.tmp"87⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\1658.tmp"C:\Users\Admin\AppData\Local\Temp\1658.tmp"88⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\16C5.tmp"C:\Users\Admin\AppData\Local\Temp\16C5.tmp"89⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\1752.tmp"C:\Users\Admin\AppData\Local\Temp\1752.tmp"90⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\17BF.tmp"C:\Users\Admin\AppData\Local\Temp\17BF.tmp"91⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\182D.tmp"C:\Users\Admin\AppData\Local\Temp\182D.tmp"92⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\18AA.tmp"C:\Users\Admin\AppData\Local\Temp\18AA.tmp"93⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\1936.tmp"C:\Users\Admin\AppData\Local\Temp\1936.tmp"94⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\19A4.tmp"C:\Users\Admin\AppData\Local\Temp\19A4.tmp"95⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\1A21.tmp"C:\Users\Admin\AppData\Local\Temp\1A21.tmp"96⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\1A9E.tmp"C:\Users\Admin\AppData\Local\Temp\1A9E.tmp"97⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\1B1B.tmp"C:\Users\Admin\AppData\Local\Temp\1B1B.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\1BB7.tmp"C:\Users\Admin\AppData\Local\Temp\1BB7.tmp"99⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\1C34.tmp"C:\Users\Admin\AppData\Local\Temp\1C34.tmp"100⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\1CC1.tmp"C:\Users\Admin\AppData\Local\Temp\1CC1.tmp"101⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\1D4D.tmp"C:\Users\Admin\AppData\Local\Temp\1D4D.tmp"102⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\1DCA.tmp"C:\Users\Admin\AppData\Local\Temp\1DCA.tmp"103⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\1E47.tmp"C:\Users\Admin\AppData\Local\Temp\1E47.tmp"104⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\1EC4.tmp"C:\Users\Admin\AppData\Local\Temp\1EC4.tmp"105⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\1F41.tmp"C:\Users\Admin\AppData\Local\Temp\1F41.tmp"106⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"107⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\202C.tmp"C:\Users\Admin\AppData\Local\Temp\202C.tmp"108⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\2099.tmp"C:\Users\Admin\AppData\Local\Temp\2099.tmp"109⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\2116.tmp"C:\Users\Admin\AppData\Local\Temp\2116.tmp"110⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\2193.tmp"C:\Users\Admin\AppData\Local\Temp\2193.tmp"111⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\2200.tmp"C:\Users\Admin\AppData\Local\Temp\2200.tmp"112⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\227D.tmp"C:\Users\Admin\AppData\Local\Temp\227D.tmp"113⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\22EB.tmp"C:\Users\Admin\AppData\Local\Temp\22EB.tmp"114⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"115⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"116⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"117⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"118⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"119⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\25D9.tmp"C:\Users\Admin\AppData\Local\Temp\25D9.tmp"120⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\2665.tmp"C:\Users\Admin\AppData\Local\Temp\2665.tmp"121⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\26F2.tmp"C:\Users\Admin\AppData\Local\Temp\26F2.tmp"122⤵PID:4512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-