Analysis
- max time kernel
120s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 18:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_f7138ab952d8b67564ac7714567fccbe_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_f7138ab952d8b67564ac7714567fccbe_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-17_f7138ab952d8b67564ac7714567fccbe_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260717-wmtekshv2l
- SHA256 ec8281f4596b57646fec113ed745ea0e1957e1b6682a34f1091f595a42e587dc
- MD5 f7138ab952d8b67564ac7714567fccbe
- SHA1 0df40233df04e3c71e86b41e0d6d259e78b3ffa3
- SHA512 7a6abe04ce4f7994a1a631fc2015e132970d245560200ea8f3e54c94aec92cb71bf3bd6a203644455a1d885e153cf447e89041006a40a89d1230c0896e8666e2
- SSDEEP 12288:NU5rCOTeij1vGmJQlf55/qSA3xyd4dC4EBat6vd2WTZwlH4Hp:NUQOJjVGmGlfST3xySX6NTSlH4Hp
- TLSH T101B4F125B585C533E68202710EE6DBE26E3B7C70572594C32BA4A63E2FB57E0D379306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4104 DFB8.tmp 3996 E073.tmp 2552 E13E.tmp 4732 E219.tmp 3356 E2C5.tmp 4236 E361.tmp 3548 E526.tmp 4296 E5D2.tmp 5504 E68E.tmp 5420 E749.tmp 2780 E824.tmp 1312 E93D.tmp 1944 E9F9.tmp 1368 EA95.tmp 2788 EB60.tmp 5916 EBFC.tmp 4384 ECF6.tmp 3536 EDA2.tmp 1508 EE4E.tmp 5584 EEEA.tmp 824 EFD5.tmp 3944 F071.tmp 2536 F0EE.tmp 4088 F19A.tmp 5940 F226.tmp 2988 F2C3.tmp 5692 F37E.tmp 4192 F478.tmp 3920 F534.tmp 4612 F5EF.tmp 3188 F6BA.tmp 3692 F737.tmp 3276 F7D3.tmp 3156 F860.tmp 3128 F8CD.tmp 4420 F94A.tmp 1808 F9D7.tmp 4512 FA54.tmp 5460 FAC1.tmp 5104 FB3E.tmp 3108 FBBB.tmp 2352 FC29.tmp 708 FCA6.tmp 3712 FD52.tmp 3964 FDBF.tmp 5272 FE5B.tmp 4832 FEF8.tmp 5688 FF75.tmp 1520 FFF2.tmp 4632 7E.tmp 4040 10B.tmp 1408 188.tmp 4224 224.tmp 3992 2D0.tmp 3124 33D.tmp 4892 3BA.tmp 2060 447.tmp 3672 4C4.tmp 5760 551.tmp 4252 5CE.tmp 5224 65A.tmp 5092 706.tmp 2324 783.tmp 5644 810.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 998D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A823.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 371A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 783.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6217.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F648.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 293F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5526.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5550.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 898F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 919.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7725.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9632.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E93D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4478.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E679.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A24C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F955.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A450.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1965.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C536.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFF.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4340 wrote to memory of 4104 4340 2026-07-17_f7138ab952d8b67564ac7714567fccbe_elex_mafia_stealc_tofsee.exe 87 PID 4104 wrote to memory of 3996 4104 DFB8.tmp 89 PID 3996 wrote to memory of 2552 3996 E073.tmp 90 PID 2552 wrote to memory of 4732 2552 E13E.tmp 91 PID 4732 wrote to memory of 3356 4732 E219.tmp 92 PID 3356 wrote to memory of 4236 3356 E2C5.tmp 93 PID 4236 wrote to memory of 3548 4236 E361.tmp 94 PID 3548 wrote to memory of 4296 3548 E526.tmp 95 PID 4296 wrote to memory of 5504 4296 E5D2.tmp 96 PID 5504 wrote to memory of 5420 5504 E68E.tmp 97 PID 5420 wrote to memory of 2780 5420 E749.tmp 98 PID 2780 wrote to memory of 1312 2780 E824.tmp 99 PID 1312 wrote to memory of 1944 1312 E93D.tmp 100 PID 1944 wrote to memory of 1368 1944 E9F9.tmp 101 PID 1368 wrote to memory of 2788 1368 EA95.tmp 102 PID 2788 wrote to memory of 5916 2788 EB60.tmp 103 PID 5916 wrote to memory of 4384 5916 EBFC.tmp 104 PID 4384 wrote to memory of 3536 4384 ECF6.tmp 105 PID 3536 wrote to memory of 1508 3536 EDA2.tmp 106 PID 1508 wrote to memory of 5584 1508 EE4E.tmp 107 PID 5584 wrote to memory of 824 5584 EEEA.tmp 108 PID 824 wrote to memory of 3944 824 EFD5.tmp 109 PID 3944 wrote to memory of 2536 3944 F071.tmp 110 PID 2536 wrote to memory of 4088 2536 F0EE.tmp 111 PID 4088 wrote to memory of 5940 4088 F19A.tmp 112 PID 5940 wrote to memory of 2988 5940 F226.tmp 113 PID 2988 wrote to memory of 5692 2988 F2C3.tmp 114 PID 5692 wrote to memory of 4192 5692 F37E.tmp 115 PID 4192 wrote to memory of 3920 4192 F478.tmp 116 PID 3920 wrote to memory of 4612 3920 F534.tmp 117 PID 4612 wrote to memory of 3188 4612 F5EF.tmp 118 PID 3188 wrote to memory of 3692 3188 F6BA.tmp 119 PID 3692 wrote to memory of 3276 3692 F737.tmp 120 PID 3276 wrote to memory of 3156 3276 F7D3.tmp 121 PID 3156 wrote to memory of 3128 3156 F860.tmp 122 PID 3128 wrote to memory of 4420 3128 F8CD.tmp 123 PID 4420 wrote to memory of 1808 4420 F94A.tmp 124 PID 1808 wrote to memory of 4512 1808 F9D7.tmp 125 PID 4512 wrote to memory of 5460 4512 FA54.tmp 126 PID 5460 wrote to memory of 5104 5460 FAC1.tmp 127 PID 5104 wrote to memory of 3108 5104 FB3E.tmp 128 PID 3108 wrote to memory of 2352 3108 FBBB.tmp 129 PID 2352 wrote to memory of 708 2352 FC29.tmp 130 PID 708 wrote to memory of 3712 708 FCA6.tmp 131 PID 3712 wrote to memory of 3964 3712 FD52.tmp 132 PID 3964 wrote to memory of 5272 3964 FDBF.tmp 133 PID 5272 wrote to memory of 4832 5272 FE5B.tmp 134 PID 4832 wrote to memory of 5688 4832 FEF8.tmp 135 PID 5688 wrote to memory of 1520 5688 FF75.tmp 136 PID 1520 wrote to memory of 4632 1520 FFF2.tmp 137 PID 4632 wrote to memory of 4040 4632 7E.tmp 138 PID 4040 wrote to memory of 1408 4040 10B.tmp 139 PID 1408 wrote to memory of 4224 1408 188.tmp 140 PID 4224 wrote to memory of 3992 4224 224.tmp 141 PID 3992 wrote to memory of 3124 3992 2D0.tmp 142 PID 3124 wrote to memory of 4892 3124 33D.tmp 143 PID 4892 wrote to memory of 2060 4892 3BA.tmp 144 PID 2060 wrote to memory of 3672 2060 447.tmp 145 PID 3672 wrote to memory of 5760 3672 4C4.tmp 146 PID 5760 wrote to memory of 4252 5760 551.tmp 147 PID 4252 wrote to memory of 5224 4252 5CE.tmp 148 PID 5224 wrote to memory of 5092 5224 65A.tmp 149 PID 5092 wrote to memory of 2324 5092 706.tmp 150 PID 2324 wrote to memory of 5644 2324 783.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_f7138ab952d8b67564ac7714567fccbe_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_f7138ab952d8b67564ac7714567fccbe_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\DFB8.tmp"C:\Users\Admin\AppData\Local\Temp\DFB8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\E073.tmp"C:\Users\Admin\AppData\Local\Temp\E073.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\E13E.tmp"C:\Users\Admin\AppData\Local\Temp\E13E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\E219.tmp"C:\Users\Admin\AppData\Local\Temp\E219.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\E2C5.tmp"C:\Users\Admin\AppData\Local\Temp\E2C5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\E361.tmp"C:\Users\Admin\AppData\Local\Temp\E361.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\E526.tmp"C:\Users\Admin\AppData\Local\Temp\E526.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\E5D2.tmp"C:\Users\Admin\AppData\Local\Temp\E5D2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\E68E.tmp"C:\Users\Admin\AppData\Local\Temp\E68E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\E749.tmp"C:\Users\Admin\AppData\Local\Temp\E749.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\E824.tmp"C:\Users\Admin\AppData\Local\Temp\E824.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\E93D.tmp"C:\Users\Admin\AppData\Local\Temp\E93D.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\E9F9.tmp"C:\Users\Admin\AppData\Local\Temp\E9F9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\EA95.tmp"C:\Users\Admin\AppData\Local\Temp\EA95.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\EB60.tmp"C:\Users\Admin\AppData\Local\Temp\EB60.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\EBFC.tmp"C:\Users\Admin\AppData\Local\Temp\EBFC.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\ECF6.tmp"C:\Users\Admin\AppData\Local\Temp\ECF6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"C:\Users\Admin\AppData\Local\Temp\EDA2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\EE4E.tmp"C:\Users\Admin\AppData\Local\Temp\EE4E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"C:\Users\Admin\AppData\Local\Temp\EEEA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\F071.tmp"C:\Users\Admin\AppData\Local\Temp\F071.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\F0EE.tmp"C:\Users\Admin\AppData\Local\Temp\F0EE.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\F19A.tmp"C:\Users\Admin\AppData\Local\Temp\F19A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\F226.tmp"C:\Users\Admin\AppData\Local\Temp\F226.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Users\Admin\AppData\Local\Temp\F2C3.tmp"C:\Users\Admin\AppData\Local\Temp\F2C3.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\F37E.tmp"C:\Users\Admin\AppData\Local\Temp\F37E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\F478.tmp"C:\Users\Admin\AppData\Local\Temp\F478.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\F534.tmp"C:\Users\Admin\AppData\Local\Temp\F534.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\F5EF.tmp"C:\Users\Admin\AppData\Local\Temp\F5EF.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\F6BA.tmp"C:\Users\Admin\AppData\Local\Temp\F6BA.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\F737.tmp"C:\Users\Admin\AppData\Local\Temp\F737.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\F7D3.tmp"C:\Users\Admin\AppData\Local\Temp\F7D3.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\F860.tmp"C:\Users\Admin\AppData\Local\Temp\F860.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\F8CD.tmp"C:\Users\Admin\AppData\Local\Temp\F8CD.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\F94A.tmp"C:\Users\Admin\AppData\Local\Temp\F94A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\FA54.tmp"C:\Users\Admin\AppData\Local\Temp\FA54.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\FAC1.tmp"C:\Users\Admin\AppData\Local\Temp\FAC1.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\FC29.tmp"C:\Users\Admin\AppData\Local\Temp\FC29.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\FCA6.tmp"C:\Users\Admin\AppData\Local\Temp\FCA6.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\FD52.tmp"C:\Users\Admin\AppData\Local\Temp\FD52.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\FDBF.tmp"C:\Users\Admin\AppData\Local\Temp\FDBF.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\FE5B.tmp"C:\Users\Admin\AppData\Local\Temp\FE5B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\FF75.tmp"C:\Users\Admin\AppData\Local\Temp\FF75.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\FFF2.tmp"C:\Users\Admin\AppData\Local\Temp\FFF2.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\7E.tmp"C:\Users\Admin\AppData\Local\Temp\7E.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\10B.tmp"C:\Users\Admin\AppData\Local\Temp\10B.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\188.tmp"C:\Users\Admin\AppData\Local\Temp\188.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\224.tmp"C:\Users\Admin\AppData\Local\Temp\224.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\2D0.tmp"C:\Users\Admin\AppData\Local\Temp\2D0.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\33D.tmp"C:\Users\Admin\AppData\Local\Temp\33D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\3BA.tmp"C:\Users\Admin\AppData\Local\Temp\3BA.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\447.tmp"C:\Users\Admin\AppData\Local\Temp\447.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\4C4.tmp"C:\Users\Admin\AppData\Local\Temp\4C4.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\551.tmp"C:\Users\Admin\AppData\Local\Temp\551.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\5CE.tmp"C:\Users\Admin\AppData\Local\Temp\5CE.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\65A.tmp"C:\Users\Admin\AppData\Local\Temp\65A.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\706.tmp"C:\Users\Admin\AppData\Local\Temp\706.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\783.tmp"C:\Users\Admin\AppData\Local\Temp\783.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\810.tmp"C:\Users\Admin\AppData\Local\Temp\810.tmp"65⤵
- Executes dropped EXE
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\88D.tmp"C:\Users\Admin\AppData\Local\Temp\88D.tmp"66⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\919.tmp"C:\Users\Admin\AppData\Local\Temp\919.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\9A6.tmp"C:\Users\Admin\AppData\Local\Temp\9A6.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\A23.tmp"C:\Users\Admin\AppData\Local\Temp\A23.tmp"69⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\AB0.tmp"C:\Users\Admin\AppData\Local\Temp\AB0.tmp"70⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\B1D.tmp"C:\Users\Admin\AppData\Local\Temp\B1D.tmp"71⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\BAA.tmp"C:\Users\Admin\AppData\Local\Temp\BAA.tmp"72⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\C36.tmp"C:\Users\Admin\AppData\Local\Temp\C36.tmp"73⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\CF2.tmp"C:\Users\Admin\AppData\Local\Temp\CF2.tmp"74⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\D7E.tmp"C:\Users\Admin\AppData\Local\Temp\D7E.tmp"75⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\E0B.tmp"C:\Users\Admin\AppData\Local\Temp\E0B.tmp"76⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\E98.tmp"C:\Users\Admin\AppData\Local\Temp\E98.tmp"77⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\F05.tmp"C:\Users\Admin\AppData\Local\Temp\F05.tmp"78⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\F72.tmp"C:\Users\Admin\AppData\Local\Temp\F72.tmp"79⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\FFF.tmp"C:\Users\Admin\AppData\Local\Temp\FFF.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\108C.tmp"C:\Users\Admin\AppData\Local\Temp\108C.tmp"81⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\10F9.tmp"C:\Users\Admin\AppData\Local\Temp\10F9.tmp"82⤵PID:260
-
C:\Users\Admin\AppData\Local\Temp\1176.tmp"C:\Users\Admin\AppData\Local\Temp\1176.tmp"83⤵PID:5508
-
C:\Users\Admin\AppData\Local\Temp\1203.tmp"C:\Users\Admin\AppData\Local\Temp\1203.tmp"84⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\12AE.tmp"C:\Users\Admin\AppData\Local\Temp\12AE.tmp"85⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\133B.tmp"C:\Users\Admin\AppData\Local\Temp\133B.tmp"86⤵PID:5912
-
C:\Users\Admin\AppData\Local\Temp\13B8.tmp"C:\Users\Admin\AppData\Local\Temp\13B8.tmp"87⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\1464.tmp"C:\Users\Admin\AppData\Local\Temp\1464.tmp"88⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\151F.tmp"C:\Users\Admin\AppData\Local\Temp\151F.tmp"89⤵PID:5652
-
C:\Users\Admin\AppData\Local\Temp\15BC.tmp"C:\Users\Admin\AppData\Local\Temp\15BC.tmp"90⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\1629.tmp"C:\Users\Admin\AppData\Local\Temp\1629.tmp"91⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\16B6.tmp"C:\Users\Admin\AppData\Local\Temp\16B6.tmp"92⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\1733.tmp"C:\Users\Admin\AppData\Local\Temp\1733.tmp"93⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\17DF.tmp"C:\Users\Admin\AppData\Local\Temp\17DF.tmp"94⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\186B.tmp"C:\Users\Admin\AppData\Local\Temp\186B.tmp"95⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\18E8.tmp"C:\Users\Admin\AppData\Local\Temp\18E8.tmp"96⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\1965.tmp"C:\Users\Admin\AppData\Local\Temp\1965.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:5164 -
C:\Users\Admin\AppData\Local\Temp\19E2.tmp"C:\Users\Admin\AppData\Local\Temp\19E2.tmp"98⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\1A7E.tmp"C:\Users\Admin\AppData\Local\Temp\1A7E.tmp"99⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\1AFB.tmp"C:\Users\Admin\AppData\Local\Temp\1AFB.tmp"100⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\1B88.tmp"C:\Users\Admin\AppData\Local\Temp\1B88.tmp"101⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\1C24.tmp"C:\Users\Admin\AppData\Local\Temp\1C24.tmp"102⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\1CB1.tmp"C:\Users\Admin\AppData\Local\Temp\1CB1.tmp"103⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\1D4D.tmp"C:\Users\Admin\AppData\Local\Temp\1D4D.tmp"104⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\1DCA.tmp"C:\Users\Admin\AppData\Local\Temp\1DCA.tmp"105⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\1E76.tmp"C:\Users\Admin\AppData\Local\Temp\1E76.tmp"106⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\1F12.tmp"C:\Users\Admin\AppData\Local\Temp\1F12.tmp"107⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\1F80.tmp"C:\Users\Admin\AppData\Local\Temp\1F80.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\202C.tmp"C:\Users\Admin\AppData\Local\Temp\202C.tmp"109⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\20A9.tmp"C:\Users\Admin\AppData\Local\Temp\20A9.tmp"110⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\2126.tmp"C:\Users\Admin\AppData\Local\Temp\2126.tmp"111⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\2193.tmp"C:\Users\Admin\AppData\Local\Temp\2193.tmp"112⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\224E.tmp"C:\Users\Admin\AppData\Local\Temp\224E.tmp"113⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\22CB.tmp"C:\Users\Admin\AppData\Local\Temp\22CB.tmp"114⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\2339.tmp"C:\Users\Admin\AppData\Local\Temp\2339.tmp"115⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\23D5.tmp"C:\Users\Admin\AppData\Local\Temp\23D5.tmp"116⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"117⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"118⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"119⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\25D9.tmp"C:\Users\Admin\AppData\Local\Temp\25D9.tmp"120⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\2656.tmp"C:\Users\Admin\AppData\Local\Temp\2656.tmp"121⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\26F2.tmp"C:\Users\Admin\AppData\Local\Temp\26F2.tmp"122⤵PID:764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-