Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 04:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_f811b503dffd74d516e8f227c9e6c377_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_f811b503dffd74d516e8f227c9e6c377_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-28_f811b503dffd74d516e8f227c9e6c377_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260728-eyl17sap9v
- SHA256 30331bf10374b37d6f07d1db9fe5a5e0e156a7c2959156f7ad87baeced1246e4
- MD5 f811b503dffd74d516e8f227c9e6c377
- SHA1 de0d92cc4f99e194e07ecd13d65f86354089ffa9
- SHA512 1d26d890a359d87fc51606579810ed68147c5b2ab214f3498bf7d1ce52a1b794c73ffa8fd74eba79c151318435c7eeb4cd13afcac797a8b22a0a846601cd15e3
- SSDEEP 12288:HU5rCOTeiJHpZKjtxu6Mxer/rZA83zPHglNZ:HUQOJJHLQtE6MxmG8jviN
- TLSH T1B6B4F1217881C032E99212314EE6EBB2197ABC255726A4C77BC0777E5FB43E1A779307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3768 D86E.tmp 2440 D90A.tmp 4772 D9C6.tmp 4160 DA81.tmp 2932 DB3D.tmp 2300 DBBA.tmp 1752 DC27.tmp 1116 DCA4.tmp 1204 DD21.tmp 3596 DDAE.tmp 4560 DE79.tmp 3104 DEF6.tmp 4512 DF54.tmp 4792 DFC1.tmp 384 E05D.tmp 628 E0FA.tmp 4344 E186.tmp 1100 E232.tmp 4540 E2CE.tmp 2284 E35B.tmp 820 E407.tmp 3976 E493.tmp 748 E520.tmp 824 E57E.tmp 4224 E60A.tmp 812 E6B6.tmp 5108 E743.tmp 776 E7A1.tmp 4032 E7FE.tmp 2348 E87B.tmp 3860 E908.tmp 4640 E9B4.tmp 4552 EA41.tmp 3508 EABE.tmp 3992 EB0C.tmp 4176 EB5A.tmp 2172 EBB8.tmp 1928 EC15.tmp 2292 EC63.tmp 220 ECD1.tmp 552 ED1F.tmp 2196 ED8C.tmp 3904 EDFA.tmp 4548 EE48.tmp 1784 EE96.tmp 3048 EEE4.tmp 2916 EF32.tmp 3516 EF90.tmp 1620 EFDE.tmp 1616 F02C.tmp 1200 F07A.tmp 3276 F0C8.tmp 1316 F126.tmp 944 F174.tmp 2720 F1C2.tmp 3708 F211.tmp 3144 F25F.tmp 4736 F2AD.tmp 2660 F2FB.tmp 1836 F359.tmp 4020 F3B6.tmp 4840 F405.tmp 4388 F453.tmp 3728 F4A1.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1642.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E375.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F760.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6869.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2371.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B62C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2054.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F170.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 136F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 237C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F07A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 456 wrote to memory of 3768 456 2026-07-28_f811b503dffd74d516e8f227c9e6c377_elex_mafia_stealc_tofsee.exe 84 PID 3768 wrote to memory of 2440 3768 D86E.tmp 85 PID 2440 wrote to memory of 4772 2440 D90A.tmp 86 PID 4772 wrote to memory of 4160 4772 D9C6.tmp 87 PID 4160 wrote to memory of 2932 4160 DA81.tmp 88 PID 2932 wrote to memory of 2300 2932 DB3D.tmp 89 PID 2300 wrote to memory of 1752 2300 DBBA.tmp 90 PID 1752 wrote to memory of 1116 1752 DC27.tmp 91 PID 1116 wrote to memory of 1204 1116 DCA4.tmp 92 PID 1204 wrote to memory of 3596 1204 DD21.tmp 93 PID 3596 wrote to memory of 4560 3596 DDAE.tmp 94 PID 4560 wrote to memory of 3104 4560 DE79.tmp 95 PID 3104 wrote to memory of 4512 3104 DEF6.tmp 96 PID 4512 wrote to memory of 4792 4512 DF54.tmp 97 PID 4792 wrote to memory of 384 4792 DFC1.tmp 98 PID 384 wrote to memory of 628 384 E05D.tmp 99 PID 628 wrote to memory of 4344 628 E0FA.tmp 100 PID 4344 wrote to memory of 1100 4344 E186.tmp 101 PID 1100 wrote to memory of 4540 1100 E232.tmp 102 PID 4540 wrote to memory of 2284 4540 E2CE.tmp 103 PID 2284 wrote to memory of 820 2284 E35B.tmp 104 PID 820 wrote to memory of 3976 820 E407.tmp 105 PID 3976 wrote to memory of 748 3976 E493.tmp 106 PID 748 wrote to memory of 824 748 E520.tmp 107 PID 824 wrote to memory of 4224 824 E57E.tmp 108 PID 4224 wrote to memory of 812 4224 E60A.tmp 109 PID 812 wrote to memory of 5108 812 E6B6.tmp 110 PID 5108 wrote to memory of 776 5108 E743.tmp 111 PID 776 wrote to memory of 4032 776 E7A1.tmp 112 PID 4032 wrote to memory of 2348 4032 E7FE.tmp 113 PID 2348 wrote to memory of 3860 2348 E87B.tmp 114 PID 3860 wrote to memory of 4640 3860 E908.tmp 115 PID 4640 wrote to memory of 4552 4640 E9B4.tmp 116 PID 4552 wrote to memory of 3508 4552 EA41.tmp 117 PID 3508 wrote to memory of 3992 3508 EABE.tmp 118 PID 3992 wrote to memory of 4176 3992 EB0C.tmp 119 PID 4176 wrote to memory of 2172 4176 EB5A.tmp 120 PID 2172 wrote to memory of 1928 2172 EBB8.tmp 121 PID 1928 wrote to memory of 2292 1928 EC15.tmp 122 PID 2292 wrote to memory of 220 2292 EC63.tmp 123 PID 220 wrote to memory of 552 220 ECD1.tmp 124 PID 552 wrote to memory of 2196 552 ED1F.tmp 125 PID 2196 wrote to memory of 3904 2196 ED8C.tmp 126 PID 3904 wrote to memory of 4548 3904 EDFA.tmp 127 PID 4548 wrote to memory of 1784 4548 EE48.tmp 128 PID 1784 wrote to memory of 3048 1784 EE96.tmp 129 PID 3048 wrote to memory of 2916 3048 EEE4.tmp 130 PID 2916 wrote to memory of 3516 2916 EF32.tmp 131 PID 3516 wrote to memory of 1620 3516 EF90.tmp 132 PID 1620 wrote to memory of 1616 1620 EFDE.tmp 133 PID 1616 wrote to memory of 1200 1616 F02C.tmp 134 PID 1200 wrote to memory of 3276 1200 F07A.tmp 135 PID 3276 wrote to memory of 1316 3276 F0C8.tmp 136 PID 1316 wrote to memory of 944 1316 F126.tmp 137 PID 944 wrote to memory of 2720 944 F174.tmp 138 PID 2720 wrote to memory of 3708 2720 F1C2.tmp 139 PID 3708 wrote to memory of 3144 3708 F211.tmp 140 PID 3144 wrote to memory of 4736 3144 F25F.tmp 141 PID 4736 wrote to memory of 2660 4736 F2AD.tmp 142 PID 2660 wrote to memory of 1836 2660 F2FB.tmp 143 PID 1836 wrote to memory of 4020 1836 F359.tmp 144 PID 4020 wrote to memory of 4840 4020 F3B6.tmp 145 PID 4840 wrote to memory of 4388 4840 F405.tmp 146 PID 4388 wrote to memory of 3728 4388 F453.tmp 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_f811b503dffd74d516e8f227c9e6c377_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_f811b503dffd74d516e8f227c9e6c377_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\D86E.tmp"C:\Users\Admin\AppData\Local\Temp\D86E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\D90A.tmp"C:\Users\Admin\AppData\Local\Temp\D90A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"C:\Users\Admin\AppData\Local\Temp\D9C6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\DA81.tmp"C:\Users\Admin\AppData\Local\Temp\DA81.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\DC27.tmp"C:\Users\Admin\AppData\Local\Temp\DC27.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"C:\Users\Admin\AppData\Local\Temp\DCA4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\DD21.tmp"C:\Users\Admin\AppData\Local\Temp\DD21.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"C:\Users\Admin\AppData\Local\Temp\DDAE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\DE79.tmp"C:\Users\Admin\AppData\Local\Temp\DE79.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"C:\Users\Admin\AppData\Local\Temp\DEF6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\DF54.tmp"C:\Users\Admin\AppData\Local\Temp\DF54.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"C:\Users\Admin\AppData\Local\Temp\DFC1.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\E05D.tmp"C:\Users\Admin\AppData\Local\Temp\E05D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\E186.tmp"C:\Users\Admin\AppData\Local\Temp\E186.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\E232.tmp"C:\Users\Admin\AppData\Local\Temp\E232.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\E35B.tmp"C:\Users\Admin\AppData\Local\Temp\E35B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\E407.tmp"C:\Users\Admin\AppData\Local\Temp\E407.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\E520.tmp"C:\Users\Admin\AppData\Local\Temp\E520.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\E57E.tmp"C:\Users\Admin\AppData\Local\Temp\E57E.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\E60A.tmp"C:\Users\Admin\AppData\Local\Temp\E60A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\E743.tmp"C:\Users\Admin\AppData\Local\Temp\E743.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\EA41.tmp"C:\Users\Admin\AppData\Local\Temp\EA41.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\EABE.tmp"C:\Users\Admin\AppData\Local\Temp\EABE.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"C:\Users\Admin\AppData\Local\Temp\EDFA.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\EE48.tmp"C:\Users\Admin\AppData\Local\Temp\EE48.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\EE96.tmp"C:\Users\Admin\AppData\Local\Temp\EE96.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\EF90.tmp"C:\Users\Admin\AppData\Local\Temp\EF90.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\F02C.tmp"C:\Users\Admin\AppData\Local\Temp\F02C.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\F07A.tmp"C:\Users\Admin\AppData\Local\Temp\F07A.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\F126.tmp"C:\Users\Admin\AppData\Local\Temp\F126.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\F211.tmp"C:\Users\Admin\AppData\Local\Temp\F211.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\F25F.tmp"C:\Users\Admin\AppData\Local\Temp\F25F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"C:\Users\Admin\AppData\Local\Temp\F2AD.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\F359.tmp"C:\Users\Admin\AppData\Local\Temp\F359.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\F405.tmp"C:\Users\Admin\AppData\Local\Temp\F405.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\F453.tmp"C:\Users\Admin\AppData\Local\Temp\F453.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"C:\Users\Admin\AppData\Local\Temp\F4A1.tmp"65⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"66⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\F53D.tmp"C:\Users\Admin\AppData\Local\Temp\F53D.tmp"67⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\F58B.tmp"C:\Users\Admin\AppData\Local\Temp\F58B.tmp"68⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"69⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\F666.tmp"C:\Users\Admin\AppData\Local\Temp\F666.tmp"70⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"C:\Users\Admin\AppData\Local\Temp\F6C4.tmp"71⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"72⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\F760.tmp"C:\Users\Admin\AppData\Local\Temp\F760.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:704 -
C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"74⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"75⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\F84A.tmp"C:\Users\Admin\AppData\Local\Temp\F84A.tmp"76⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"C:\Users\Admin\AppData\Local\Temp\F8A8.tmp"77⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"78⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"79⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\F992.tmp"C:\Users\Admin\AppData\Local\Temp\F992.tmp"80⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"C:\Users\Admin\AppData\Local\Temp\F9E1.tmp"81⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"82⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"C:\Users\Admin\AppData\Local\Temp\FA8C.tmp"83⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\FADB.tmp"C:\Users\Admin\AppData\Local\Temp\FADB.tmp"84⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\FB29.tmp"C:\Users\Admin\AppData\Local\Temp\FB29.tmp"85⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\FB77.tmp"C:\Users\Admin\AppData\Local\Temp\FB77.tmp"86⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"C:\Users\Admin\AppData\Local\Temp\FBC5.tmp"87⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"88⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\FC71.tmp"C:\Users\Admin\AppData\Local\Temp\FC71.tmp"89⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"90⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"91⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"C:\Users\Admin\AppData\Local\Temp\FD5B.tmp"92⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"C:\Users\Admin\AppData\Local\Temp\FDC9.tmp"93⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\FE17.tmp"C:\Users\Admin\AppData\Local\Temp\FE17.tmp"94⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\FE65.tmp"C:\Users\Admin\AppData\Local\Temp\FE65.tmp"95⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"C:\Users\Admin\AppData\Local\Temp\FEC3.tmp"96⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\FF11.tmp"C:\Users\Admin\AppData\Local\Temp\FF11.tmp"97⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"C:\Users\Admin\AppData\Local\Temp\FF6E.tmp"98⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"C:\Users\Admin\AppData\Local\Temp\FFCC.tmp"99⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"100⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\68.tmp"C:\Users\Admin\AppData\Local\Temp\68.tmp"101⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\D6.tmp"C:\Users\Admin\AppData\Local\Temp\D6.tmp"102⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\124.tmp"C:\Users\Admin\AppData\Local\Temp\124.tmp"103⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"104⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\1D0.tmp"C:\Users\Admin\AppData\Local\Temp\1D0.tmp"105⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\22E.tmp"C:\Users\Admin\AppData\Local\Temp\22E.tmp"106⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"107⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"108⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\318.tmp"C:\Users\Admin\AppData\Local\Temp\318.tmp"109⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"110⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\3B4.tmp"C:\Users\Admin\AppData\Local\Temp\3B4.tmp"111⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"112⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\450.tmp"C:\Users\Admin\AppData\Local\Temp\450.tmp"113⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\49F.tmp"C:\Users\Admin\AppData\Local\Temp\49F.tmp"114⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"115⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\56A.tmp"C:\Users\Admin\AppData\Local\Temp\56A.tmp"116⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\5D7.tmp"C:\Users\Admin\AppData\Local\Temp\5D7.tmp"117⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\635.tmp"C:\Users\Admin\AppData\Local\Temp\635.tmp"118⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"119⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\6F0.tmp"C:\Users\Admin\AppData\Local\Temp\6F0.tmp"120⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"121⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\79C.tmp"C:\Users\Admin\AppData\Local\Temp\79C.tmp"122⤵PID:1892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-