Analysis
- max time kernel
121s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 01:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_f34e69b65b08bc4429bf318a9008a441_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_f34e69b65b08bc4429bf318a9008a441_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-17_f34e69b65b08bc4429bf318a9008a441_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260718-bwfvmaby6k
- SHA256 8a4877470ea15b068037d3fd6b34cfca82dbc0884486fa5a8240e7547f5ea75e
- MD5 f34e69b65b08bc4429bf318a9008a441
- SHA1 8a0bf3db1228c97a96621f156432a958d9ad174f
- SHA512 e94d0d3223078fdce4f91e1947687f9ec1c5e4bf428d85e8ad325af869c091598f3102e2ab2ce2ef01e70f4376b949068947d3f5a177be111101c7d9d6c61f59
- SSDEEP 12288:wU5rCOTeiDf3pGYjb4nI/wacLq985NZ+3/v+I9hUG2VA:wUQOJD/p1jEI1CNGEA
- TLSH T1FFE4D02177D88632E5F7037859B5E6604D7EBD326722D6CF2F8425AE0A71BC09A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1928 DF89.tmp 4348 E035.tmp 5236 E0A2.tmp 3264 E238.tmp 4200 E3BF.tmp 3548 E507.tmp 4764 E65F.tmp 3968 E759.tmp 5560 E8A1.tmp 6044 E9BA.tmp 4160 EAE3.tmp 260 EBED.tmp 2788 ED06.tmp 2592 EE1F.tmp 1128 EF19.tmp 1452 EFF4.tmp 3180 F10D.tmp 5836 F226.tmp 5876 F340.tmp 5884 F43A.tmp 1252 F524.tmp 2988 F5EF.tmp 4232 F718.tmp 2992 F7F3.tmp 5108 F8ED.tmp 4208 F9C7.tmp 2752 FAF0.tmp 4908 FC19.tmp 3128 FD04.tmp 3660 FDFE.tmp 4748 FF26.tmp 2360 4F.tmp 3500 1A7.tmp 3060 2A1.tmp 5188 34D.tmp 1548 418.tmp 5100 4F3.tmp 2064 5AE.tmp 1520 65A.tmp 5160 725.tmp 2516 7F0.tmp 4592 8AC.tmp 764 967.tmp 4100 A42.tmp 4396 B0D.tmp 2236 BF8.tmp 5428 CF2.tmp 5900 DFB.tmp 1304 EB7.tmp 5976 F72.tmp 5332 FE0.tmp 2576 105D.tmp 5792 10CA.tmp 5676 1157.tmp 4484 11E3.tmp 472 129F.tmp 3988 132B.tmp 3544 1389.tmp 4636 1435.tmp 5504 14B2.tmp 4976 153F.tmp 2628 15EB.tmp 1456 1687.tmp 5952 1704.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 257B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 372E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A402.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2154.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A63F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F340.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 563F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E57F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4756.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F718.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 275B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 515D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 178C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4979.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 981B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4850.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8687.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B884.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 824C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7996.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBCD.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4876 wrote to memory of 1928 4876 2026-07-17_f34e69b65b08bc4429bf318a9008a441_elex_mafia_stealc_tofsee.exe 88 PID 1928 wrote to memory of 4348 1928 DF89.tmp 89 PID 4348 wrote to memory of 5236 4348 E035.tmp 90 PID 5236 wrote to memory of 3264 5236 E0A2.tmp 91 PID 3264 wrote to memory of 4200 3264 E238.tmp 92 PID 4200 wrote to memory of 3548 4200 E3BF.tmp 93 PID 3548 wrote to memory of 4764 3548 E507.tmp 94 PID 4764 wrote to memory of 3968 4764 E65F.tmp 95 PID 3968 wrote to memory of 5560 3968 E759.tmp 96 PID 5560 wrote to memory of 6044 5560 E8A1.tmp 97 PID 6044 wrote to memory of 4160 6044 E9BA.tmp 98 PID 4160 wrote to memory of 260 4160 EAE3.tmp 99 PID 260 wrote to memory of 2788 260 EBED.tmp 100 PID 2788 wrote to memory of 2592 2788 ED06.tmp 101 PID 2592 wrote to memory of 1128 2592 EE1F.tmp 102 PID 1128 wrote to memory of 1452 1128 EF19.tmp 103 PID 1452 wrote to memory of 3180 1452 EFF4.tmp 104 PID 3180 wrote to memory of 5836 3180 F10D.tmp 105 PID 5836 wrote to memory of 5876 5836 F226.tmp 106 PID 5876 wrote to memory of 5884 5876 F340.tmp 107 PID 5884 wrote to memory of 1252 5884 F43A.tmp 108 PID 1252 wrote to memory of 2988 1252 F524.tmp 109 PID 2988 wrote to memory of 4232 2988 F5EF.tmp 110 PID 4232 wrote to memory of 2992 4232 F718.tmp 111 PID 2992 wrote to memory of 5108 2992 F7F3.tmp 112 PID 5108 wrote to memory of 4208 5108 F8ED.tmp 113 PID 4208 wrote to memory of 2752 4208 F9C7.tmp 114 PID 2752 wrote to memory of 4908 2752 FAF0.tmp 115 PID 4908 wrote to memory of 3128 4908 FC19.tmp 116 PID 3128 wrote to memory of 3660 3128 FD04.tmp 117 PID 3660 wrote to memory of 4748 3660 FDFE.tmp 118 PID 4748 wrote to memory of 2360 4748 FF26.tmp 119 PID 2360 wrote to memory of 3500 2360 4F.tmp 120 PID 3500 wrote to memory of 3060 3500 1A7.tmp 121 PID 3060 wrote to memory of 5188 3060 2A1.tmp 122 PID 5188 wrote to memory of 1548 5188 34D.tmp 123 PID 1548 wrote to memory of 5100 1548 418.tmp 124 PID 5100 wrote to memory of 2064 5100 4F3.tmp 125 PID 2064 wrote to memory of 1520 2064 5AE.tmp 126 PID 1520 wrote to memory of 5160 1520 65A.tmp 127 PID 5160 wrote to memory of 2516 5160 725.tmp 128 PID 2516 wrote to memory of 4592 2516 7F0.tmp 129 PID 4592 wrote to memory of 764 4592 8AC.tmp 130 PID 764 wrote to memory of 4100 764 967.tmp 131 PID 4100 wrote to memory of 4396 4100 A42.tmp 132 PID 4396 wrote to memory of 2236 4396 B0D.tmp 133 PID 2236 wrote to memory of 5428 2236 BF8.tmp 134 PID 5428 wrote to memory of 5900 5428 CF2.tmp 135 PID 5900 wrote to memory of 1304 5900 DFB.tmp 136 PID 1304 wrote to memory of 5976 1304 EB7.tmp 137 PID 5976 wrote to memory of 5332 5976 F72.tmp 138 PID 5332 wrote to memory of 2576 5332 FE0.tmp 139 PID 2576 wrote to memory of 5792 2576 105D.tmp 140 PID 5792 wrote to memory of 5676 5792 10CA.tmp 141 PID 5676 wrote to memory of 4484 5676 1157.tmp 142 PID 4484 wrote to memory of 472 4484 11E3.tmp 143 PID 472 wrote to memory of 3988 472 129F.tmp 144 PID 3988 wrote to memory of 3544 3988 132B.tmp 145 PID 3544 wrote to memory of 4636 3544 1389.tmp 146 PID 4636 wrote to memory of 5504 4636 1435.tmp 147 PID 5504 wrote to memory of 4976 5504 14B2.tmp 148 PID 4976 wrote to memory of 2628 4976 153F.tmp 149 PID 2628 wrote to memory of 1456 2628 15EB.tmp 150 PID 1456 wrote to memory of 5952 1456 1687.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_f34e69b65b08bc4429bf318a9008a441_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_f34e69b65b08bc4429bf318a9008a441_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\DF89.tmp"C:\Users\Admin\AppData\Local\Temp\DF89.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\E035.tmp"C:\Users\Admin\AppData\Local\Temp\E035.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\E0A2.tmp"C:\Users\Admin\AppData\Local\Temp\E0A2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\E238.tmp"C:\Users\Admin\AppData\Local\Temp\E238.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\E3BF.tmp"C:\Users\Admin\AppData\Local\Temp\E3BF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\E507.tmp"C:\Users\Admin\AppData\Local\Temp\E507.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\E65F.tmp"C:\Users\Admin\AppData\Local\Temp\E65F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\E759.tmp"C:\Users\Admin\AppData\Local\Temp\E759.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Users\Admin\AppData\Local\Temp\E9BA.tmp"C:\Users\Admin\AppData\Local\Temp\E9BA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"C:\Users\Admin\AppData\Local\Temp\EAE3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\EBED.tmp"C:\Users\Admin\AppData\Local\Temp\EBED.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\ED06.tmp"C:\Users\Admin\AppData\Local\Temp\ED06.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\EE1F.tmp"C:\Users\Admin\AppData\Local\Temp\EE1F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\EF19.tmp"C:\Users\Admin\AppData\Local\Temp\EF19.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\EFF4.tmp"C:\Users\Admin\AppData\Local\Temp\EFF4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\F10D.tmp"C:\Users\Admin\AppData\Local\Temp\F10D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\F226.tmp"C:\Users\Admin\AppData\Local\Temp\F226.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\F340.tmp"C:\Users\Admin\AppData\Local\Temp\F340.tmp"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\F43A.tmp"C:\Users\Admin\AppData\Local\Temp\F43A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\F524.tmp"C:\Users\Admin\AppData\Local\Temp\F524.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\F5EF.tmp"C:\Users\Admin\AppData\Local\Temp\F5EF.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\F718.tmp"C:\Users\Admin\AppData\Local\Temp\F718.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\F8ED.tmp"C:\Users\Admin\AppData\Local\Temp\F8ED.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\F9C7.tmp"C:\Users\Admin\AppData\Local\Temp\F9C7.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\FAF0.tmp"C:\Users\Admin\AppData\Local\Temp\FAF0.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\FC19.tmp"C:\Users\Admin\AppData\Local\Temp\FC19.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\FD04.tmp"C:\Users\Admin\AppData\Local\Temp\FD04.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\FF26.tmp"C:\Users\Admin\AppData\Local\Temp\FF26.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\4F.tmp"C:\Users\Admin\AppData\Local\Temp\4F.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\1A7.tmp"C:\Users\Admin\AppData\Local\Temp\1A7.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\2A1.tmp"C:\Users\Admin\AppData\Local\Temp\2A1.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\34D.tmp"C:\Users\Admin\AppData\Local\Temp\34D.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5188 -
C:\Users\Admin\AppData\Local\Temp\418.tmp"C:\Users\Admin\AppData\Local\Temp\418.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\4F3.tmp"C:\Users\Admin\AppData\Local\Temp\4F3.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\5AE.tmp"C:\Users\Admin\AppData\Local\Temp\5AE.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\65A.tmp"C:\Users\Admin\AppData\Local\Temp\65A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\725.tmp"C:\Users\Admin\AppData\Local\Temp\725.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\7F0.tmp"C:\Users\Admin\AppData\Local\Temp\7F0.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\8AC.tmp"C:\Users\Admin\AppData\Local\Temp\8AC.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\967.tmp"C:\Users\Admin\AppData\Local\Temp\967.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\A42.tmp"C:\Users\Admin\AppData\Local\Temp\A42.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\B0D.tmp"C:\Users\Admin\AppData\Local\Temp\B0D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\BF8.tmp"C:\Users\Admin\AppData\Local\Temp\BF8.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\CF2.tmp"C:\Users\Admin\AppData\Local\Temp\CF2.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Users\Admin\AppData\Local\Temp\DFB.tmp"C:\Users\Admin\AppData\Local\Temp\DFB.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\EB7.tmp"C:\Users\Admin\AppData\Local\Temp\EB7.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\F72.tmp"C:\Users\Admin\AppData\Local\Temp\F72.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\FE0.tmp"C:\Users\Admin\AppData\Local\Temp\FE0.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\105D.tmp"C:\Users\Admin\AppData\Local\Temp\105D.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\10CA.tmp"C:\Users\Admin\AppData\Local\Temp\10CA.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\1157.tmp"C:\Users\Admin\AppData\Local\Temp\1157.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Users\Admin\AppData\Local\Temp\11E3.tmp"C:\Users\Admin\AppData\Local\Temp\11E3.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\129F.tmp"C:\Users\Admin\AppData\Local\Temp\129F.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\132B.tmp"C:\Users\Admin\AppData\Local\Temp\132B.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\1389.tmp"C:\Users\Admin\AppData\Local\Temp\1389.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\1435.tmp"C:\Users\Admin\AppData\Local\Temp\1435.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\14B2.tmp"C:\Users\Admin\AppData\Local\Temp\14B2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\153F.tmp"C:\Users\Admin\AppData\Local\Temp\153F.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\15EB.tmp"C:\Users\Admin\AppData\Local\Temp\15EB.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\1687.tmp"C:\Users\Admin\AppData\Local\Temp\1687.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\1704.tmp"C:\Users\Admin\AppData\Local\Temp\1704.tmp"65⤵
- Executes dropped EXE
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\17A0.tmp"C:\Users\Admin\AppData\Local\Temp\17A0.tmp"66⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\182D.tmp"C:\Users\Admin\AppData\Local\Temp\182D.tmp"67⤵PID:5256
-
C:\Users\Admin\AppData\Local\Temp\189A.tmp"C:\Users\Admin\AppData\Local\Temp\189A.tmp"68⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\1917.tmp"C:\Users\Admin\AppData\Local\Temp\1917.tmp"69⤵PID:5396
-
C:\Users\Admin\AppData\Local\Temp\1994.tmp"C:\Users\Admin\AppData\Local\Temp\1994.tmp"70⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\1A21.tmp"C:\Users\Admin\AppData\Local\Temp\1A21.tmp"71⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\1ACD.tmp"C:\Users\Admin\AppData\Local\Temp\1ACD.tmp"72⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\1B4A.tmp"C:\Users\Admin\AppData\Local\Temp\1B4A.tmp"73⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\1BD6.tmp"C:\Users\Admin\AppData\Local\Temp\1BD6.tmp"74⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\1C92.tmp"C:\Users\Admin\AppData\Local\Temp\1C92.tmp"75⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\1D2E.tmp"C:\Users\Admin\AppData\Local\Temp\1D2E.tmp"76⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\1DE9.tmp"C:\Users\Admin\AppData\Local\Temp\1DE9.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\1E76.tmp"C:\Users\Admin\AppData\Local\Temp\1E76.tmp"78⤵PID:5856
-
C:\Users\Admin\AppData\Local\Temp\1F03.tmp"C:\Users\Admin\AppData\Local\Temp\1F03.tmp"79⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\1F80.tmp"C:\Users\Admin\AppData\Local\Temp\1F80.tmp"80⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\200C.tmp"C:\Users\Admin\AppData\Local\Temp\200C.tmp"81⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\2089.tmp"C:\Users\Admin\AppData\Local\Temp\2089.tmp"82⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\2154.tmp"C:\Users\Admin\AppData\Local\Temp\2154.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\2210.tmp"C:\Users\Admin\AppData\Local\Temp\2210.tmp"84⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\22CB.tmp"C:\Users\Admin\AppData\Local\Temp\22CB.tmp"85⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\2348.tmp"C:\Users\Admin\AppData\Local\Temp\2348.tmp"86⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\23D5.tmp"C:\Users\Admin\AppData\Local\Temp\23D5.tmp"87⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"88⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"89⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\257B.tmp"C:\Users\Admin\AppData\Local\Temp\257B.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"91⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\26B3.tmp"C:\Users\Admin\AppData\Local\Temp\26B3.tmp"92⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\2750.tmp"C:\Users\Admin\AppData\Local\Temp\2750.tmp"93⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\27EC.tmp"C:\Users\Admin\AppData\Local\Temp\27EC.tmp"94⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\2879.tmp"C:\Users\Admin\AppData\Local\Temp\2879.tmp"95⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\2905.tmp"C:\Users\Admin\AppData\Local\Temp\2905.tmp"96⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\29B1.tmp"C:\Users\Admin\AppData\Local\Temp\29B1.tmp"97⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\2A2E.tmp"C:\Users\Admin\AppData\Local\Temp\2A2E.tmp"98⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\2AAB.tmp"C:\Users\Admin\AppData\Local\Temp\2AAB.tmp"99⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\2B38.tmp"C:\Users\Admin\AppData\Local\Temp\2B38.tmp"100⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\2BA5.tmp"C:\Users\Admin\AppData\Local\Temp\2BA5.tmp"101⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\2C32.tmp"C:\Users\Admin\AppData\Local\Temp\2C32.tmp"102⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\2CBE.tmp"C:\Users\Admin\AppData\Local\Temp\2CBE.tmp"103⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\2D6A.tmp"C:\Users\Admin\AppData\Local\Temp\2D6A.tmp"104⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\2DE7.tmp"C:\Users\Admin\AppData\Local\Temp\2DE7.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:5328 -
C:\Users\Admin\AppData\Local\Temp\2E74.tmp"C:\Users\Admin\AppData\Local\Temp\2E74.tmp"106⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\2F10.tmp"C:\Users\Admin\AppData\Local\Temp\2F10.tmp"107⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\2F7D.tmp"C:\Users\Admin\AppData\Local\Temp\2F7D.tmp"108⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\300A.tmp"C:\Users\Admin\AppData\Local\Temp\300A.tmp"109⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\30C6.tmp"C:\Users\Admin\AppData\Local\Temp\30C6.tmp"110⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\3171.tmp"C:\Users\Admin\AppData\Local\Temp\3171.tmp"111⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\31FE.tmp"C:\Users\Admin\AppData\Local\Temp\31FE.tmp"112⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\329A.tmp"C:\Users\Admin\AppData\Local\Temp\329A.tmp"113⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\3337.tmp"C:\Users\Admin\AppData\Local\Temp\3337.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\33D3.tmp"C:\Users\Admin\AppData\Local\Temp\33D3.tmp"115⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\345F.tmp"C:\Users\Admin\AppData\Local\Temp\345F.tmp"116⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\352B.tmp"C:\Users\Admin\AppData\Local\Temp\352B.tmp"117⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\35A8.tmp"C:\Users\Admin\AppData\Local\Temp\35A8.tmp"118⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\3625.tmp"C:\Users\Admin\AppData\Local\Temp\3625.tmp"119⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\36B1.tmp"C:\Users\Admin\AppData\Local\Temp\36B1.tmp"120⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\372E.tmp"C:\Users\Admin\AppData\Local\Temp\372E.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\37CA.tmp"C:\Users\Admin\AppData\Local\Temp\37CA.tmp"122⤵PID:2136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-