Analysis
- max time kernel
123s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 16:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_f8f2fc3681eb7aa108330e6c37bbdf94_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_f8f2fc3681eb7aa108330e6c37bbdf94_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-03_f8f2fc3681eb7aa108330e6c37bbdf94_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260803-twmbhsvxbx
- SHA256 308b38a5469a7e06a23ef9c46d7269836271acd237e58460abe5ad8f61cff773
- MD5 f8f2fc3681eb7aa108330e6c37bbdf94
- SHA1 c76f1df2f940ec64826d911d50acc8f8e4871c7d
- SHA512 79f749bea834301203ac459e6853d9612a09f24db3c382b8981b98ca5164000d6efdc98e536d3305ab97dbf0838a39a03680128be65c996e97abcede444f7afa
- SSDEEP 12288:wU5rCOTeiDxXwk2M1ZLwfg1c/zW97fNVES2MNZ+3/v+I9hUG2VA:wUQOJDxgk2M1Vb1EW1NVn2MNGEA
- TLSH T1ADE4D02173D88632E5FB037859B5E6614D7EBD326722D6CF2F9016AE0971BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5792 DFF6.tmp 1076 E11F.tmp 1688 E1CB.tmp 3380 E342.tmp 4768 E4C8.tmp 4440 E5B3.tmp 5052 E6FB.tmp 1692 E824.tmp 3656 E91E.tmp 1800 EA27.tmp 1456 EB31.tmp 4072 EC89.tmp 4960 ED83.tmp 1480 EE8C.tmp 5396 EFA6.tmp 4216 F0BF.tmp 3924 F1F7.tmp 2380 F2E2.tmp 2148 F3CC.tmp 2588 F543.tmp 5932 F6AB.tmp 3048 F7E3.tmp 5692 F8FC.tmp 2984 FA25.tmp 4336 FB3E.tmp 2404 FC19.tmp 3692 FD52.tmp 4284 FE2C.tmp 2828 FF26.tmp 5304 7E.tmp 3652 188.tmp 2436 2EF.tmp 924 3DA.tmp 4316 4A5.tmp 4456 551.tmp 744 5ED.tmp 5272 6A8.tmp 4076 764.tmp 4872 810.tmp 1768 8CB.tmp 2604 987.tmp 4224 A42.tmp 4896 ADE.tmp 4968 B7B.tmp 4396 C17.tmp 2236 CE2.tmp 2076 DAD.tmp 4880 E59.tmp 1700 EE6.tmp 2968 F82.tmp 5948 100F.tmp 1340 109B.tmp 4056 1109.tmp 1544 1186.tmp 4732 11F3.tmp 1668 128F.tmp 4012 131C.tmp 3752 1389.tmp 4144 1416.tmp 2572 14A2.tmp 4320 152F.tmp 2684 15AC.tmp 1260 1639.tmp 5896 16D5.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 702B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7135.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8454.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 242E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 879B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A048.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F07C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F54E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1389.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3058.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C063.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1672.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 217F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 271C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 591E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A247.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1186.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 860A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 922A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 354A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9471.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B45D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 145.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2905.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C267.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4876 wrote to memory of 5792 4876 2026-08-03_f8f2fc3681eb7aa108330e6c37bbdf94_elex_mafia_stealc_tofsee.exe 88 PID 5792 wrote to memory of 1076 5792 DFF6.tmp 89 PID 1076 wrote to memory of 1688 1076 E11F.tmp 90 PID 1688 wrote to memory of 3380 1688 E1CB.tmp 91 PID 3380 wrote to memory of 4768 3380 E342.tmp 92 PID 4768 wrote to memory of 4440 4768 E4C8.tmp 93 PID 4440 wrote to memory of 5052 4440 E5B3.tmp 94 PID 5052 wrote to memory of 1692 5052 E6FB.tmp 95 PID 1692 wrote to memory of 3656 1692 E824.tmp 96 PID 3656 wrote to memory of 1800 3656 E91E.tmp 97 PID 1800 wrote to memory of 1456 1800 EA27.tmp 98 PID 1456 wrote to memory of 4072 1456 EB31.tmp 99 PID 4072 wrote to memory of 4960 4072 EC89.tmp 100 PID 4960 wrote to memory of 1480 4960 ED83.tmp 101 PID 1480 wrote to memory of 5396 1480 EE8C.tmp 102 PID 5396 wrote to memory of 4216 5396 EFA6.tmp 103 PID 4216 wrote to memory of 3924 4216 F0BF.tmp 104 PID 3924 wrote to memory of 2380 3924 F1F7.tmp 105 PID 2380 wrote to memory of 2148 2380 F2E2.tmp 106 PID 2148 wrote to memory of 2588 2148 F3CC.tmp 107 PID 2588 wrote to memory of 5932 2588 F543.tmp 108 PID 5932 wrote to memory of 3048 5932 F6AB.tmp 109 PID 3048 wrote to memory of 5692 3048 F7E3.tmp 110 PID 5692 wrote to memory of 2984 5692 F8FC.tmp 111 PID 2984 wrote to memory of 4336 2984 FA25.tmp 112 PID 4336 wrote to memory of 2404 4336 FB3E.tmp 113 PID 2404 wrote to memory of 3692 2404 FC19.tmp 114 PID 3692 wrote to memory of 4284 3692 FD52.tmp 115 PID 4284 wrote to memory of 2828 4284 FE2C.tmp 116 PID 2828 wrote to memory of 5304 2828 FF26.tmp 117 PID 5304 wrote to memory of 3652 5304 7E.tmp 118 PID 3652 wrote to memory of 2436 3652 188.tmp 119 PID 2436 wrote to memory of 924 2436 2EF.tmp 120 PID 924 wrote to memory of 4316 924 3DA.tmp 121 PID 4316 wrote to memory of 4456 4316 4A5.tmp 122 PID 4456 wrote to memory of 744 4456 551.tmp 123 PID 744 wrote to memory of 5272 744 5ED.tmp 124 PID 5272 wrote to memory of 4076 5272 6A8.tmp 125 PID 4076 wrote to memory of 4872 4076 764.tmp 126 PID 4872 wrote to memory of 1768 4872 810.tmp 127 PID 1768 wrote to memory of 2604 1768 8CB.tmp 128 PID 2604 wrote to memory of 4224 2604 987.tmp 129 PID 4224 wrote to memory of 4896 4224 A42.tmp 130 PID 4896 wrote to memory of 4968 4896 ADE.tmp 131 PID 4968 wrote to memory of 4396 4968 B7B.tmp 132 PID 4396 wrote to memory of 2236 4396 C17.tmp 133 PID 2236 wrote to memory of 2076 2236 CE2.tmp 134 PID 2076 wrote to memory of 4880 2076 DAD.tmp 135 PID 4880 wrote to memory of 1700 4880 E59.tmp 136 PID 1700 wrote to memory of 2968 1700 EE6.tmp 137 PID 2968 wrote to memory of 5948 2968 F82.tmp 138 PID 5948 wrote to memory of 1340 5948 100F.tmp 139 PID 1340 wrote to memory of 4056 1340 109B.tmp 140 PID 4056 wrote to memory of 1544 4056 1109.tmp 141 PID 1544 wrote to memory of 4732 1544 1186.tmp 142 PID 4732 wrote to memory of 1668 4732 11F3.tmp 143 PID 1668 wrote to memory of 4012 1668 128F.tmp 144 PID 4012 wrote to memory of 3752 4012 131C.tmp 145 PID 3752 wrote to memory of 4144 3752 1389.tmp 146 PID 4144 wrote to memory of 2572 4144 1416.tmp 147 PID 2572 wrote to memory of 4320 2572 14A2.tmp 148 PID 4320 wrote to memory of 2684 4320 152F.tmp 149 PID 2684 wrote to memory of 1260 2684 15AC.tmp 150 PID 1260 wrote to memory of 5896 1260 1639.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_f8f2fc3681eb7aa108330e6c37bbdf94_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_f8f2fc3681eb7aa108330e6c37bbdf94_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"C:\Users\Admin\AppData\Local\Temp\DFF6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\E11F.tmp"C:\Users\Admin\AppData\Local\Temp\E11F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\E1CB.tmp"C:\Users\Admin\AppData\Local\Temp\E1CB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\E342.tmp"C:\Users\Admin\AppData\Local\Temp\E342.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\E5B3.tmp"C:\Users\Admin\AppData\Local\Temp\E5B3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\E6FB.tmp"C:\Users\Admin\AppData\Local\Temp\E6FB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\E824.tmp"C:\Users\Admin\AppData\Local\Temp\E824.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\E91E.tmp"C:\Users\Admin\AppData\Local\Temp\E91E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\EA27.tmp"C:\Users\Admin\AppData\Local\Temp\EA27.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\EB31.tmp"C:\Users\Admin\AppData\Local\Temp\EB31.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\EC89.tmp"C:\Users\Admin\AppData\Local\Temp\EC89.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\ED83.tmp"C:\Users\Admin\AppData\Local\Temp\ED83.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\EFA6.tmp"C:\Users\Admin\AppData\Local\Temp\EFA6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\F1F7.tmp"C:\Users\Admin\AppData\Local\Temp\F1F7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"C:\Users\Admin\AppData\Local\Temp\F2E2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\F3CC.tmp"C:\Users\Admin\AppData\Local\Temp\F3CC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\F543.tmp"C:\Users\Admin\AppData\Local\Temp\F543.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\F7E3.tmp"C:\Users\Admin\AppData\Local\Temp\F7E3.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\F8FC.tmp"C:\Users\Admin\AppData\Local\Temp\F8FC.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\FA25.tmp"C:\Users\Admin\AppData\Local\Temp\FA25.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\FC19.tmp"C:\Users\Admin\AppData\Local\Temp\FC19.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\FD52.tmp"C:\Users\Admin\AppData\Local\Temp\FD52.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\FE2C.tmp"C:\Users\Admin\AppData\Local\Temp\FE2C.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\FF26.tmp"C:\Users\Admin\AppData\Local\Temp\FF26.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\7E.tmp"C:\Users\Admin\AppData\Local\Temp\7E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Users\Admin\AppData\Local\Temp\188.tmp"C:\Users\Admin\AppData\Local\Temp\188.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\2EF.tmp"C:\Users\Admin\AppData\Local\Temp\2EF.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\3DA.tmp"C:\Users\Admin\AppData\Local\Temp\3DA.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\4A5.tmp"C:\Users\Admin\AppData\Local\Temp\4A5.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\551.tmp"C:\Users\Admin\AppData\Local\Temp\551.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\5ED.tmp"C:\Users\Admin\AppData\Local\Temp\5ED.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\6A8.tmp"C:\Users\Admin\AppData\Local\Temp\6A8.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5272 -
C:\Users\Admin\AppData\Local\Temp\764.tmp"C:\Users\Admin\AppData\Local\Temp\764.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\810.tmp"C:\Users\Admin\AppData\Local\Temp\810.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\8CB.tmp"C:\Users\Admin\AppData\Local\Temp\8CB.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\987.tmp"C:\Users\Admin\AppData\Local\Temp\987.tmp"42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\A42.tmp"C:\Users\Admin\AppData\Local\Temp\A42.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\ADE.tmp"C:\Users\Admin\AppData\Local\Temp\ADE.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\B7B.tmp"C:\Users\Admin\AppData\Local\Temp\B7B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\C17.tmp"C:\Users\Admin\AppData\Local\Temp\C17.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\CE2.tmp"C:\Users\Admin\AppData\Local\Temp\CE2.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\DAD.tmp"C:\Users\Admin\AppData\Local\Temp\DAD.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\E59.tmp"C:\Users\Admin\AppData\Local\Temp\E59.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\EE6.tmp"C:\Users\Admin\AppData\Local\Temp\EE6.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\F82.tmp"C:\Users\Admin\AppData\Local\Temp\F82.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\100F.tmp"C:\Users\Admin\AppData\Local\Temp\100F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\109B.tmp"C:\Users\Admin\AppData\Local\Temp\109B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\1109.tmp"C:\Users\Admin\AppData\Local\Temp\1109.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\1186.tmp"C:\Users\Admin\AppData\Local\Temp\1186.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\11F3.tmp"C:\Users\Admin\AppData\Local\Temp\11F3.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\128F.tmp"C:\Users\Admin\AppData\Local\Temp\128F.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\131C.tmp"C:\Users\Admin\AppData\Local\Temp\131C.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\1389.tmp"C:\Users\Admin\AppData\Local\Temp\1389.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\1416.tmp"C:\Users\Admin\AppData\Local\Temp\1416.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\14A2.tmp"C:\Users\Admin\AppData\Local\Temp\14A2.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\152F.tmp"C:\Users\Admin\AppData\Local\Temp\152F.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\15AC.tmp"C:\Users\Admin\AppData\Local\Temp\15AC.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\1639.tmp"C:\Users\Admin\AppData\Local\Temp\1639.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\16D5.tmp"C:\Users\Admin\AppData\Local\Temp\16D5.tmp"65⤵
- Executes dropped EXE
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\1762.tmp"C:\Users\Admin\AppData\Local\Temp\1762.tmp"66⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\17EE.tmp"C:\Users\Admin\AppData\Local\Temp\17EE.tmp"67⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\185C.tmp"C:\Users\Admin\AppData\Local\Temp\185C.tmp"68⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\18E8.tmp"C:\Users\Admin\AppData\Local\Temp\18E8.tmp"69⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\19A4.tmp"C:\Users\Admin\AppData\Local\Temp\19A4.tmp"70⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\1A50.tmp"C:\Users\Admin\AppData\Local\Temp\1A50.tmp"71⤵PID:5788
-
C:\Users\Admin\AppData\Local\Temp\1AEC.tmp"C:\Users\Admin\AppData\Local\Temp\1AEC.tmp"72⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\1B78.tmp"C:\Users\Admin\AppData\Local\Temp\1B78.tmp"73⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\1C05.tmp"C:\Users\Admin\AppData\Local\Temp\1C05.tmp"74⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\1C72.tmp"C:\Users\Admin\AppData\Local\Temp\1C72.tmp"75⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"76⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\1D5D.tmp"C:\Users\Admin\AppData\Local\Temp\1D5D.tmp"77⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\1DE9.tmp"C:\Users\Admin\AppData\Local\Temp\1DE9.tmp"78⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\1E86.tmp"C:\Users\Admin\AppData\Local\Temp\1E86.tmp"79⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\1EF3.tmp"C:\Users\Admin\AppData\Local\Temp\1EF3.tmp"80⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\1F80.tmp"C:\Users\Admin\AppData\Local\Temp\1F80.tmp"81⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\202C.tmp"C:\Users\Admin\AppData\Local\Temp\202C.tmp"82⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\2099.tmp"C:\Users\Admin\AppData\Local\Temp\2099.tmp"83⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\2116.tmp"C:\Users\Admin\AppData\Local\Temp\2116.tmp"84⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\21A3.tmp"C:\Users\Admin\AppData\Local\Temp\21A3.tmp"85⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\2210.tmp"C:\Users\Admin\AppData\Local\Temp\2210.tmp"86⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\228D.tmp"C:\Users\Admin\AppData\Local\Temp\228D.tmp"87⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\230A.tmp"C:\Users\Admin\AppData\Local\Temp\230A.tmp"88⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\2387.tmp"C:\Users\Admin\AppData\Local\Temp\2387.tmp"89⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\23F4.tmp"C:\Users\Admin\AppData\Local\Temp\23F4.tmp"90⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"91⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"92⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\259A.tmp"C:\Users\Admin\AppData\Local\Temp\259A.tmp"93⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"94⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"95⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\2711.tmp"C:\Users\Admin\AppData\Local\Temp\2711.tmp"96⤵PID:5464
-
C:\Users\Admin\AppData\Local\Temp\276F.tmp"C:\Users\Admin\AppData\Local\Temp\276F.tmp"97⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\27DC.tmp"C:\Users\Admin\AppData\Local\Temp\27DC.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\2879.tmp"C:\Users\Admin\AppData\Local\Temp\2879.tmp"99⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\2905.tmp"C:\Users\Admin\AppData\Local\Temp\2905.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:764 -
C:\Users\Admin\AppData\Local\Temp\2973.tmp"C:\Users\Admin\AppData\Local\Temp\2973.tmp"101⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\2A0F.tmp"C:\Users\Admin\AppData\Local\Temp\2A0F.tmp"102⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\2A8C.tmp"C:\Users\Admin\AppData\Local\Temp\2A8C.tmp"103⤵PID:5428
-
C:\Users\Admin\AppData\Local\Temp\2B09.tmp"C:\Users\Admin\AppData\Local\Temp\2B09.tmp"104⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\2B86.tmp"C:\Users\Admin\AppData\Local\Temp\2B86.tmp"105⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\2C03.tmp"C:\Users\Admin\AppData\Local\Temp\2C03.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\2C70.tmp"C:\Users\Admin\AppData\Local\Temp\2C70.tmp"107⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\2CFD.tmp"C:\Users\Admin\AppData\Local\Temp\2CFD.tmp"108⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\2D7A.tmp"C:\Users\Admin\AppData\Local\Temp\2D7A.tmp"109⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\2E16.tmp"C:\Users\Admin\AppData\Local\Temp\2E16.tmp"110⤵PID:5236
-
C:\Users\Admin\AppData\Local\Temp\2EA3.tmp"C:\Users\Admin\AppData\Local\Temp\2EA3.tmp"111⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\2F20.tmp"C:\Users\Admin\AppData\Local\Temp\2F20.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\2FBC.tmp"C:\Users\Admin\AppData\Local\Temp\2FBC.tmp"113⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\3058.tmp"C:\Users\Admin\AppData\Local\Temp\3058.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\30F4.tmp"C:\Users\Admin\AppData\Local\Temp\30F4.tmp"115⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\3191.tmp"C:\Users\Admin\AppData\Local\Temp\3191.tmp"116⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\320E.tmp"C:\Users\Admin\AppData\Local\Temp\320E.tmp"117⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\32AA.tmp"C:\Users\Admin\AppData\Local\Temp\32AA.tmp"118⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\3337.tmp"C:\Users\Admin\AppData\Local\Temp\3337.tmp"119⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\33B4.tmp"C:\Users\Admin\AppData\Local\Temp\33B4.tmp"120⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\3431.tmp"C:\Users\Admin\AppData\Local\Temp\3431.tmp"121⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\34BD.tmp"C:\Users\Admin\AppData\Local\Temp\34BD.tmp"122⤵PID:4092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-