Analysis
- max time kernel
132s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 03:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_fe683650cc42b51b8004779313b6f649_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_fe683650cc42b51b8004779313b6f649_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_fe683650cc42b51b8004779313b6f649_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample260803-dks2xsbc95
- SHA256 2cb30de79312e69467d4966f63aedf2047f2e7fde39c389a8350352a8db0a384
- MD5 fe683650cc42b51b8004779313b6f649
- SHA1 345470489422475b5e6a40a5b568afa0878074ed
- SHA512 04dc61a0c009f93b0a924eecf214cd4a74970b06933c49b80edefce37ecdcc31c47670689d3426c15d219a56c799003d67402659c47b1543317fe9869dc1a64d
- SSDEEP 12288:9U5rCOTei6K781jklmewsyzUJ17oZwjqZoXWjdqpby1grA70G+o:9UQOJ6KLmXsb17swjqqGh4yATXo
- TLSH T1D4E40121B985C032E9D212708FD5EBB1586ABC75673668C73B80776E2FB12E1D379207
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6020 DD75.tmp 3248 DE6F.tmp 5388 DF79.tmp 4924 E015.tmp 5364 E12F.tmp 1800 E248.tmp 3436 E371.tmp 4644 E42C.tmp 4052 E545.tmp 1900 E611.tmp 52 E6EB.tmp 120 E7B6.tmp 260 E8A1.tmp 4344 E94D.tmp 1184 E9E9.tmp 1208 EAC4.tmp 3148 EB9E.tmp 5532 EC4A.tmp 4184 ED44.tmp 4016 EE00.tmp 5444 EEBB.tmp 3968 EF86.tmp 5556 F013.tmp 8 F080.tmp 2636 F13C.tmp 1732 F1F7.tmp 3524 F2E2.tmp 1268 F3EB.tmp 4064 F4A7.tmp 2256 F572.tmp 2680 F62E.tmp 2844 F718.tmp 3076 F802.tmp 1808 F87F.tmp 2484 F8FC.tmp 3316 F999.tmp 5756 FA35.tmp 3404 FAB2.tmp 1152 FB2F.tmp 4828 FBBB.tmp 3392 FC38.tmp 3144 FC96.tmp 2996 FD13.tmp 1904 FDAF.tmp 5432 FE3C.tmp 4588 FEB9.tmp 2768 FF26.tmp 964 FF94.tmp 1600 11.tmp 2316 AD.tmp 4056 11A.tmp 596 1A7.tmp 3904 224.tmp 5080 2B1.tmp 4512 32E.tmp 3156 3BA.tmp 4012 457.tmp 4804 512.tmp 4284 58F.tmp 4024 60C.tmp 2852 699.tmp 4980 725.tmp 6084 7B2.tmp 4124 83F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 778E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A729.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F444.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 612C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A74D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1624.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D492.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E011.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C928.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 979E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3390.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1687.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6080.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F752.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1980.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 725E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 758A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 655.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3729.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B874.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 595C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9353.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3663.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 493F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2557.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 433F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D26F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 152A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 852F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60F9.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4712 wrote to memory of 6020 4712 2026-08-02_fe683650cc42b51b8004779313b6f649_elex_mafia_stealc_tofsee.exe 88 PID 6020 wrote to memory of 3248 6020 DD75.tmp 89 PID 3248 wrote to memory of 5388 3248 DE6F.tmp 90 PID 5388 wrote to memory of 4924 5388 DF79.tmp 91 PID 4924 wrote to memory of 5364 4924 E015.tmp 92 PID 5364 wrote to memory of 1800 5364 E12F.tmp 93 PID 1800 wrote to memory of 3436 1800 E248.tmp 94 PID 3436 wrote to memory of 4644 3436 E371.tmp 95 PID 4644 wrote to memory of 4052 4644 E42C.tmp 96 PID 4052 wrote to memory of 1900 4052 E545.tmp 97 PID 1900 wrote to memory of 52 1900 E611.tmp 98 PID 52 wrote to memory of 120 52 E6EB.tmp 99 PID 120 wrote to memory of 260 120 E7B6.tmp 100 PID 260 wrote to memory of 4344 260 E8A1.tmp 101 PID 4344 wrote to memory of 1184 4344 E94D.tmp 102 PID 1184 wrote to memory of 1208 1184 E9E9.tmp 103 PID 1208 wrote to memory of 3148 1208 EAC4.tmp 104 PID 3148 wrote to memory of 5532 3148 EB9E.tmp 105 PID 5532 wrote to memory of 4184 5532 EC4A.tmp 106 PID 4184 wrote to memory of 4016 4184 ED44.tmp 107 PID 4016 wrote to memory of 5444 4016 EE00.tmp 108 PID 5444 wrote to memory of 3968 5444 EEBB.tmp 109 PID 3968 wrote to memory of 5556 3968 EF86.tmp 110 PID 5556 wrote to memory of 8 5556 F013.tmp 111 PID 8 wrote to memory of 2636 8 F080.tmp 112 PID 2636 wrote to memory of 1732 2636 F13C.tmp 113 PID 1732 wrote to memory of 3524 1732 F1F7.tmp 114 PID 3524 wrote to memory of 1268 3524 F2E2.tmp 115 PID 1268 wrote to memory of 4064 1268 F3EB.tmp 116 PID 4064 wrote to memory of 2256 4064 F4A7.tmp 117 PID 2256 wrote to memory of 2680 2256 F572.tmp 118 PID 2680 wrote to memory of 2844 2680 F62E.tmp 119 PID 2844 wrote to memory of 3076 2844 F718.tmp 120 PID 3076 wrote to memory of 1808 3076 F802.tmp 121 PID 1808 wrote to memory of 2484 1808 F87F.tmp 122 PID 2484 wrote to memory of 3316 2484 F8FC.tmp 123 PID 3316 wrote to memory of 5756 3316 F999.tmp 124 PID 5756 wrote to memory of 3404 5756 FA35.tmp 125 PID 3404 wrote to memory of 1152 3404 FAB2.tmp 126 PID 1152 wrote to memory of 4828 1152 FB2F.tmp 127 PID 4828 wrote to memory of 3392 4828 FBBB.tmp 128 PID 3392 wrote to memory of 3144 3392 FC38.tmp 129 PID 3144 wrote to memory of 2996 3144 FC96.tmp 130 PID 2996 wrote to memory of 1904 2996 FD13.tmp 131 PID 1904 wrote to memory of 5432 1904 FDAF.tmp 132 PID 5432 wrote to memory of 4588 5432 FE3C.tmp 133 PID 4588 wrote to memory of 2768 4588 FEB9.tmp 134 PID 2768 wrote to memory of 964 2768 FF26.tmp 135 PID 964 wrote to memory of 1600 964 FF94.tmp 136 PID 1600 wrote to memory of 2316 1600 11.tmp 137 PID 2316 wrote to memory of 4056 2316 AD.tmp 138 PID 4056 wrote to memory of 596 4056 11A.tmp 139 PID 596 wrote to memory of 3904 596 1A7.tmp 140 PID 3904 wrote to memory of 5080 3904 224.tmp 141 PID 5080 wrote to memory of 4512 5080 2B1.tmp 142 PID 4512 wrote to memory of 3156 4512 32E.tmp 143 PID 3156 wrote to memory of 4012 3156 3BA.tmp 144 PID 4012 wrote to memory of 4804 4012 457.tmp 145 PID 4804 wrote to memory of 4284 4804 512.tmp 146 PID 4284 wrote to memory of 4024 4284 58F.tmp 147 PID 4024 wrote to memory of 2852 4024 60C.tmp 148 PID 2852 wrote to memory of 4980 2852 699.tmp 149 PID 4980 wrote to memory of 6084 4980 725.tmp 150 PID 6084 wrote to memory of 4124 6084 7B2.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_fe683650cc42b51b8004779313b6f649_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_fe683650cc42b51b8004779313b6f649_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\DD75.tmp"C:\Users\Admin\AppData\Local\Temp\DD75.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"C:\Users\Admin\AppData\Local\Temp\DE6F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\DF79.tmp"C:\Users\Admin\AppData\Local\Temp\DF79.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Users\Admin\AppData\Local\Temp\E015.tmp"C:\Users\Admin\AppData\Local\Temp\E015.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\E12F.tmp"C:\Users\Admin\AppData\Local\Temp\E12F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\E248.tmp"C:\Users\Admin\AppData\Local\Temp\E248.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\E371.tmp"C:\Users\Admin\AppData\Local\Temp\E371.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\E42C.tmp"C:\Users\Admin\AppData\Local\Temp\E42C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\E545.tmp"C:\Users\Admin\AppData\Local\Temp\E545.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\E611.tmp"C:\Users\Admin\AppData\Local\Temp\E611.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"C:\Users\Admin\AppData\Local\Temp\E6EB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"C:\Users\Admin\AppData\Local\Temp\E7B6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"C:\Users\Admin\AppData\Local\Temp\E8A1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Users\Admin\AppData\Local\Temp\E94D.tmp"C:\Users\Admin\AppData\Local\Temp\E94D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\E9E9.tmp"C:\Users\Admin\AppData\Local\Temp\E9E9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\EAC4.tmp"C:\Users\Admin\AppData\Local\Temp\EAC4.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"C:\Users\Admin\AppData\Local\Temp\EB9E.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Users\Admin\AppData\Local\Temp\ED44.tmp"C:\Users\Admin\AppData\Local\Temp\ED44.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\EE00.tmp"C:\Users\Admin\AppData\Local\Temp\EE00.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\EEBB.tmp"C:\Users\Admin\AppData\Local\Temp\EEBB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\EF86.tmp"C:\Users\Admin\AppData\Local\Temp\EF86.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\F013.tmp"C:\Users\Admin\AppData\Local\Temp\F013.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\F080.tmp"C:\Users\Admin\AppData\Local\Temp\F080.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\F13C.tmp"C:\Users\Admin\AppData\Local\Temp\F13C.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\F1F7.tmp"C:\Users\Admin\AppData\Local\Temp\F1F7.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\F3EB.tmp"C:\Users\Admin\AppData\Local\Temp\F3EB.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\F572.tmp"C:\Users\Admin\AppData\Local\Temp\F572.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\F62E.tmp"C:\Users\Admin\AppData\Local\Temp\F62E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\F718.tmp"C:\Users\Admin\AppData\Local\Temp\F718.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\F802.tmp"C:\Users\Admin\AppData\Local\Temp\F802.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\F87F.tmp"C:\Users\Admin\AppData\Local\Temp\F87F.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\F8FC.tmp"C:\Users\Admin\AppData\Local\Temp\F8FC.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\F999.tmp"C:\Users\Admin\AppData\Local\Temp\F999.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\FA35.tmp"C:\Users\Admin\AppData\Local\Temp\FA35.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\FAB2.tmp"C:\Users\Admin\AppData\Local\Temp\FAB2.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\FB2F.tmp"C:\Users\Admin\AppData\Local\Temp\FB2F.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"C:\Users\Admin\AppData\Local\Temp\FBBB.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\FC38.tmp"C:\Users\Admin\AppData\Local\Temp\FC38.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\FC96.tmp"C:\Users\Admin\AppData\Local\Temp\FC96.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\FD13.tmp"C:\Users\Admin\AppData\Local\Temp\FD13.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\FDAF.tmp"C:\Users\Admin\AppData\Local\Temp\FDAF.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\FF26.tmp"C:\Users\Admin\AppData\Local\Temp\FF26.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\FF94.tmp"C:\Users\Admin\AppData\Local\Temp\FF94.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\11.tmp"C:\Users\Admin\AppData\Local\Temp\11.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\AD.tmp"C:\Users\Admin\AppData\Local\Temp\AD.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\11A.tmp"C:\Users\Admin\AppData\Local\Temp\11A.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\1A7.tmp"C:\Users\Admin\AppData\Local\Temp\1A7.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
C:\Users\Admin\AppData\Local\Temp\224.tmp"C:\Users\Admin\AppData\Local\Temp\224.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\2B1.tmp"C:\Users\Admin\AppData\Local\Temp\2B1.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\32E.tmp"C:\Users\Admin\AppData\Local\Temp\32E.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\3BA.tmp"C:\Users\Admin\AppData\Local\Temp\3BA.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\457.tmp"C:\Users\Admin\AppData\Local\Temp\457.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\512.tmp"C:\Users\Admin\AppData\Local\Temp\512.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\58F.tmp"C:\Users\Admin\AppData\Local\Temp\58F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\60C.tmp"C:\Users\Admin\AppData\Local\Temp\60C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\699.tmp"C:\Users\Admin\AppData\Local\Temp\699.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\725.tmp"C:\Users\Admin\AppData\Local\Temp\725.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\7B2.tmp"C:\Users\Admin\AppData\Local\Temp\7B2.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\83F.tmp"C:\Users\Admin\AppData\Local\Temp\83F.tmp"65⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\8BC.tmp"C:\Users\Admin\AppData\Local\Temp\8BC.tmp"66⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\929.tmp"C:\Users\Admin\AppData\Local\Temp\929.tmp"67⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\9C5.tmp"C:\Users\Admin\AppData\Local\Temp\9C5.tmp"68⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\A61.tmp"C:\Users\Admin\AppData\Local\Temp\A61.tmp"69⤵PID:5320
-
C:\Users\Admin\AppData\Local\Temp\AEE.tmp"C:\Users\Admin\AppData\Local\Temp\AEE.tmp"70⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\B6B.tmp"C:\Users\Admin\AppData\Local\Temp\B6B.tmp"71⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\BE8.tmp"C:\Users\Admin\AppData\Local\Temp\BE8.tmp"72⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\C75.tmp"C:\Users\Admin\AppData\Local\Temp\C75.tmp"73⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\D11.tmp"C:\Users\Admin\AppData\Local\Temp\D11.tmp"74⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\D8E.tmp"C:\Users\Admin\AppData\Local\Temp\D8E.tmp"75⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\E0B.tmp"C:\Users\Admin\AppData\Local\Temp\E0B.tmp"76⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\E78.tmp"C:\Users\Admin\AppData\Local\Temp\E78.tmp"77⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\EE6.tmp"C:\Users\Admin\AppData\Local\Temp\EE6.tmp"78⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\F63.tmp"C:\Users\Admin\AppData\Local\Temp\F63.tmp"79⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\FE0.tmp"C:\Users\Admin\AppData\Local\Temp\FE0.tmp"80⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\106C.tmp"C:\Users\Admin\AppData\Local\Temp\106C.tmp"81⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\10DA.tmp"C:\Users\Admin\AppData\Local\Temp\10DA.tmp"82⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\1157.tmp"C:\Users\Admin\AppData\Local\Temp\1157.tmp"83⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\11D4.tmp"C:\Users\Admin\AppData\Local\Temp\11D4.tmp"84⤵PID:5924
-
C:\Users\Admin\AppData\Local\Temp\1251.tmp"C:\Users\Admin\AppData\Local\Temp\1251.tmp"85⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\12DD.tmp"C:\Users\Admin\AppData\Local\Temp\12DD.tmp"86⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\135A.tmp"C:\Users\Admin\AppData\Local\Temp\135A.tmp"87⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\13D7.tmp"C:\Users\Admin\AppData\Local\Temp\13D7.tmp"88⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\1474.tmp"C:\Users\Admin\AppData\Local\Temp\1474.tmp"89⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\1510.tmp"C:\Users\Admin\AppData\Local\Temp\1510.tmp"90⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\159C.tmp"C:\Users\Admin\AppData\Local\Temp\159C.tmp"91⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\160A.tmp"C:\Users\Admin\AppData\Local\Temp\160A.tmp"92⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\1687.tmp"C:\Users\Admin\AppData\Local\Temp\1687.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\1713.tmp"C:\Users\Admin\AppData\Local\Temp\1713.tmp"94⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\1790.tmp"C:\Users\Admin\AppData\Local\Temp\1790.tmp"95⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\182D.tmp"C:\Users\Admin\AppData\Local\Temp\182D.tmp"96⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\189A.tmp"C:\Users\Admin\AppData\Local\Temp\189A.tmp"97⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\1936.tmp"C:\Users\Admin\AppData\Local\Temp\1936.tmp"98⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\19A4.tmp"C:\Users\Admin\AppData\Local\Temp\19A4.tmp"99⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\1A30.tmp"C:\Users\Admin\AppData\Local\Temp\1A30.tmp"100⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\1ABD.tmp"C:\Users\Admin\AppData\Local\Temp\1ABD.tmp"101⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\1B59.tmp"C:\Users\Admin\AppData\Local\Temp\1B59.tmp"102⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"C:\Users\Admin\AppData\Local\Temp\1BC7.tmp"103⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\1C34.tmp"C:\Users\Admin\AppData\Local\Temp\1C34.tmp"104⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\1CD0.tmp"C:\Users\Admin\AppData\Local\Temp\1CD0.tmp"105⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\1D3E.tmp"C:\Users\Admin\AppData\Local\Temp\1D3E.tmp"106⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\1DAB.tmp"C:\Users\Admin\AppData\Local\Temp\1DAB.tmp"107⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\1E18.tmp"C:\Users\Admin\AppData\Local\Temp\1E18.tmp"108⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"109⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\1F32.tmp"C:\Users\Admin\AppData\Local\Temp\1F32.tmp"110⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"C:\Users\Admin\AppData\Local\Temp\1FAF.tmp"111⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\202C.tmp"C:\Users\Admin\AppData\Local\Temp\202C.tmp"112⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2099.tmp"C:\Users\Admin\AppData\Local\Temp\2099.tmp"113⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\2126.tmp"C:\Users\Admin\AppData\Local\Temp\2126.tmp"114⤵PID:5288
-
C:\Users\Admin\AppData\Local\Temp\21A3.tmp"C:\Users\Admin\AppData\Local\Temp\21A3.tmp"115⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\224E.tmp"C:\Users\Admin\AppData\Local\Temp\224E.tmp"116⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\22BC.tmp"C:\Users\Admin\AppData\Local\Temp\22BC.tmp"117⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\2348.tmp"C:\Users\Admin\AppData\Local\Temp\2348.tmp"118⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\23C5.tmp"C:\Users\Admin\AppData\Local\Temp\23C5.tmp"119⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"120⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\24BF.tmp"C:\Users\Admin\AppData\Local\Temp\24BF.tmp"121⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\253C.tmp"C:\Users\Admin\AppData\Local\Temp\253C.tmp"122⤵PID:5376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-