Analysis
- max time kernel
127s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 02:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_5a2172989ec4fbcdf78c31ebb1a0ad37_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_5a2172989ec4fbcdf78c31ebb1a0ad37_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-03_5a2172989ec4fbcdf78c31ebb1a0ad37_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260804-ddpe6a1bjc
- SHA256 04c6c6e09b4488662430333f0f4cde1b145ebd15822f3f04a37bf8cd973b7f23
- MD5 5a2172989ec4fbcdf78c31ebb1a0ad37
- SHA1 93550b56ea56139bc75606617eecd0dd23850b63
- SHA512 9fa5fc61c7da0fec325e7f6ae7999f3b67ca4d31e700ed947e4feca767db6977f955942dcec9f709c0244d90842ce2899aebb878b8aa0d09da7cadf2cdee06bd
- SSDEEP 12288:NU5rCOTeijhCjxGfb0HyIdPTYI8BTZwlH:NUQOJj887AYIkTSlH
- TLSH T16FB4F125B684C032E6D312710EEAEBB2293A7C714736A4C76784677E2FB56D1E735302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2940 DA00.tmp 3472 DB09.tmp 4620 DBF4.tmp 4164 DCAF.tmp 2516 DD7A.tmp 3852 DE65.tmp 1052 DF20.tmp 2812 DFDC.tmp 3396 E097.tmp 1120 E162.tmp 5008 E22D.tmp 4224 E2CA.tmp 4292 E366.tmp 2284 E412.tmp 832 E4DD.tmp 1464 E5A8.tmp 5512 E692.tmp 244 E72F.tmp 3404 E809.tmp 6124 E8C5.tmp 5628 E951.tmp 2016 E9FD.tmp 5984 EAE8.tmp 4536 EBE2.tmp 4956 EC6E.tmp 2400 ED39.tmp 2604 EDF5.tmp 360 EE82.tmp 6020 EF1E.tmp 3016 EFE9.tmp 3540 F095.tmp 3268 F170.tmp 5212 F23B.tmp 5680 F2A8.tmp 5220 F335.tmp 3768 F3C1.tmp 3512 F43E.tmp 3164 F4CB.tmp 4288 F558.tmp 3780 F5D5.tmp 2912 F652.tmp 1664 F6DE.tmp 3944 F74C.tmp 936 F7F7.tmp 6024 F874.tmp 1668 F8F1.tmp 1648 F96E.tmp 4596 F9FB.tmp 4628 FA78.tmp 4816 FAF5.tmp 3388 FB72.tmp 1080 FC1E.tmp 4232 FC8B.tmp 5856 FD28.tmp 4632 FD95.tmp 3160 FE12.tmp 704 FE9F.tmp 4800 FF1C.tmp 1228 FFA8.tmp 5896 25.tmp 4208 93.tmp 1268 12F.tmp 2220 19C.tmp 2752 229.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 907E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1733.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3605.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F43E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A648.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F65C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1687.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E162.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F874.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 637E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2735.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B617.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1553.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6737.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 964B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 713A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B519.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2940 2524 2026-08-03_5a2172989ec4fbcdf78c31ebb1a0ad37_elex_mafia_stealc_tofsee.exe 90 PID 2940 wrote to memory of 3472 2940 DA00.tmp 91 PID 3472 wrote to memory of 4620 3472 DB09.tmp 92 PID 4620 wrote to memory of 4164 4620 DBF4.tmp 93 PID 4164 wrote to memory of 2516 4164 DCAF.tmp 94 PID 2516 wrote to memory of 3852 2516 DD7A.tmp 95 PID 3852 wrote to memory of 1052 3852 DE65.tmp 96 PID 1052 wrote to memory of 2812 1052 DF20.tmp 97 PID 2812 wrote to memory of 3396 2812 DFDC.tmp 98 PID 3396 wrote to memory of 1120 3396 E097.tmp 99 PID 1120 wrote to memory of 5008 1120 E162.tmp 100 PID 5008 wrote to memory of 4224 5008 E22D.tmp 101 PID 4224 wrote to memory of 4292 4224 E2CA.tmp 102 PID 4292 wrote to memory of 2284 4292 E366.tmp 103 PID 2284 wrote to memory of 832 2284 E412.tmp 104 PID 832 wrote to memory of 1464 832 E4DD.tmp 105 PID 1464 wrote to memory of 5512 1464 E5A8.tmp 106 PID 5512 wrote to memory of 244 5512 E692.tmp 107 PID 244 wrote to memory of 3404 244 E72F.tmp 108 PID 3404 wrote to memory of 6124 3404 E809.tmp 109 PID 6124 wrote to memory of 5628 6124 E8C5.tmp 110 PID 5628 wrote to memory of 2016 5628 E951.tmp 111 PID 2016 wrote to memory of 5984 2016 E9FD.tmp 112 PID 5984 wrote to memory of 4536 5984 EAE8.tmp 113 PID 4536 wrote to memory of 4956 4536 EBE2.tmp 114 PID 4956 wrote to memory of 2400 4956 EC6E.tmp 115 PID 2400 wrote to memory of 2604 2400 ED39.tmp 116 PID 2604 wrote to memory of 360 2604 EDF5.tmp 117 PID 360 wrote to memory of 6020 360 EE82.tmp 118 PID 6020 wrote to memory of 3016 6020 EF1E.tmp 119 PID 3016 wrote to memory of 3540 3016 EFE9.tmp 120 PID 3540 wrote to memory of 3268 3540 F095.tmp 121 PID 3268 wrote to memory of 5212 3268 F170.tmp 122 PID 5212 wrote to memory of 5680 5212 F23B.tmp 123 PID 5680 wrote to memory of 5220 5680 F2A8.tmp 124 PID 5220 wrote to memory of 3768 5220 F335.tmp 125 PID 3768 wrote to memory of 3512 3768 F3C1.tmp 126 PID 3512 wrote to memory of 3164 3512 F43E.tmp 127 PID 3164 wrote to memory of 4288 3164 F4CB.tmp 128 PID 4288 wrote to memory of 3780 4288 F558.tmp 129 PID 3780 wrote to memory of 2912 3780 F5D5.tmp 130 PID 2912 wrote to memory of 1664 2912 F652.tmp 131 PID 1664 wrote to memory of 3944 1664 F6DE.tmp 132 PID 3944 wrote to memory of 936 3944 F74C.tmp 133 PID 936 wrote to memory of 6024 936 F7F7.tmp 134 PID 6024 wrote to memory of 1668 6024 F874.tmp 135 PID 1668 wrote to memory of 1648 1668 F8F1.tmp 136 PID 1648 wrote to memory of 4596 1648 F96E.tmp 137 PID 4596 wrote to memory of 4628 4596 F9FB.tmp 138 PID 4628 wrote to memory of 4816 4628 FA78.tmp 139 PID 4816 wrote to memory of 3388 4816 FAF5.tmp 140 PID 3388 wrote to memory of 1080 3388 FB72.tmp 141 PID 1080 wrote to memory of 4232 1080 FC1E.tmp 142 PID 4232 wrote to memory of 5856 4232 FC8B.tmp 143 PID 5856 wrote to memory of 4632 5856 FD28.tmp 144 PID 4632 wrote to memory of 3160 4632 FD95.tmp 145 PID 3160 wrote to memory of 704 3160 FE12.tmp 146 PID 704 wrote to memory of 4800 704 FE9F.tmp 147 PID 4800 wrote to memory of 1228 4800 FF1C.tmp 148 PID 1228 wrote to memory of 5896 1228 FFA8.tmp 149 PID 5896 wrote to memory of 4208 5896 25.tmp 150 PID 4208 wrote to memory of 1268 4208 93.tmp 151 PID 1268 wrote to memory of 2220 1268 12F.tmp 152 PID 2220 wrote to memory of 2752 2220 19C.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_5a2172989ec4fbcdf78c31ebb1a0ad37_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_5a2172989ec4fbcdf78c31ebb1a0ad37_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\DA00.tmp"C:\Users\Admin\AppData\Local\Temp\DA00.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\DB09.tmp"C:\Users\Admin\AppData\Local\Temp\DB09.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\DBF4.tmp"C:\Users\Admin\AppData\Local\Temp\DBF4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\DCAF.tmp"C:\Users\Admin\AppData\Local\Temp\DCAF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\DE65.tmp"C:\Users\Admin\AppData\Local\Temp\DE65.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\DF20.tmp"C:\Users\Admin\AppData\Local\Temp\DF20.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\DFDC.tmp"C:\Users\Admin\AppData\Local\Temp\DFDC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\E097.tmp"C:\Users\Admin\AppData\Local\Temp\E097.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\E162.tmp"C:\Users\Admin\AppData\Local\Temp\E162.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\E22D.tmp"C:\Users\Admin\AppData\Local\Temp\E22D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\E2CA.tmp"C:\Users\Admin\AppData\Local\Temp\E2CA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\E366.tmp"C:\Users\Admin\AppData\Local\Temp\E366.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\E412.tmp"C:\Users\Admin\AppData\Local\Temp\E412.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\E4DD.tmp"C:\Users\Admin\AppData\Local\Temp\E4DD.tmp"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\E5A8.tmp"C:\Users\Admin\AppData\Local\Temp\E5A8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\E692.tmp"C:\Users\Admin\AppData\Local\Temp\E692.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\E72F.tmp"C:\Users\Admin\AppData\Local\Temp\E72F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\E809.tmp"C:\Users\Admin\AppData\Local\Temp\E809.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\E8C5.tmp"C:\Users\Admin\AppData\Local\Temp\E8C5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\E951.tmp"C:\Users\Admin\AppData\Local\Temp\E951.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\E9FD.tmp"C:\Users\Admin\AppData\Local\Temp\E9FD.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\EAE8.tmp"C:\Users\Admin\AppData\Local\Temp\EAE8.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5984 -
C:\Users\Admin\AppData\Local\Temp\EBE2.tmp"C:\Users\Admin\AppData\Local\Temp\EBE2.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\ED39.tmp"C:\Users\Admin\AppData\Local\Temp\ED39.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\EDF5.tmp"C:\Users\Admin\AppData\Local\Temp\EDF5.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\EE82.tmp"C:\Users\Admin\AppData\Local\Temp\EE82.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\EF1E.tmp"C:\Users\Admin\AppData\Local\Temp\EF1E.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\EFE9.tmp"C:\Users\Admin\AppData\Local\Temp\EFE9.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\F095.tmp"C:\Users\Admin\AppData\Local\Temp\F095.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\F170.tmp"C:\Users\Admin\AppData\Local\Temp\F170.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\F23B.tmp"C:\Users\Admin\AppData\Local\Temp\F23B.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"C:\Users\Admin\AppData\Local\Temp\F3C1.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\F43E.tmp"C:\Users\Admin\AppData\Local\Temp\F43E.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"C:\Users\Admin\AppData\Local\Temp\F4CB.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\F558.tmp"C:\Users\Admin\AppData\Local\Temp\F558.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\F5D5.tmp"C:\Users\Admin\AppData\Local\Temp\F5D5.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\F652.tmp"C:\Users\Admin\AppData\Local\Temp\F652.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\F6DE.tmp"C:\Users\Admin\AppData\Local\Temp\F6DE.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\F74C.tmp"C:\Users\Admin\AppData\Local\Temp\F74C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\F7F7.tmp"C:\Users\Admin\AppData\Local\Temp\F7F7.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\F874.tmp"C:\Users\Admin\AppData\Local\Temp\F874.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\F8F1.tmp"C:\Users\Admin\AppData\Local\Temp\F8F1.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\F96E.tmp"C:\Users\Admin\AppData\Local\Temp\F96E.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\F9FB.tmp"C:\Users\Admin\AppData\Local\Temp\F9FB.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\FA78.tmp"C:\Users\Admin\AppData\Local\Temp\FA78.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\FAF5.tmp"C:\Users\Admin\AppData\Local\Temp\FAF5.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\FB72.tmp"C:\Users\Admin\AppData\Local\Temp\FB72.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\FC1E.tmp"C:\Users\Admin\AppData\Local\Temp\FC1E.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\FC8B.tmp"C:\Users\Admin\AppData\Local\Temp\FC8B.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\FD28.tmp"C:\Users\Admin\AppData\Local\Temp\FD28.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Users\Admin\AppData\Local\Temp\FD95.tmp"C:\Users\Admin\AppData\Local\Temp\FD95.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\FE12.tmp"C:\Users\Admin\AppData\Local\Temp\FE12.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"C:\Users\Admin\AppData\Local\Temp\FE9F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\FF1C.tmp"C:\Users\Admin\AppData\Local\Temp\FF1C.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\FFA8.tmp"C:\Users\Admin\AppData\Local\Temp\FFA8.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\25.tmp"C:\Users\Admin\AppData\Local\Temp\25.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\93.tmp"C:\Users\Admin\AppData\Local\Temp\93.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\12F.tmp"C:\Users\Admin\AppData\Local\Temp\12F.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\19C.tmp"C:\Users\Admin\AppData\Local\Temp\19C.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\229.tmp"C:\Users\Admin\AppData\Local\Temp\229.tmp"65⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\296.tmp"C:\Users\Admin\AppData\Local\Temp\296.tmp"66⤵PID:5356
-
C:\Users\Admin\AppData\Local\Temp\323.tmp"C:\Users\Admin\AppData\Local\Temp\323.tmp"67⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\3AF.tmp"C:\Users\Admin\AppData\Local\Temp\3AF.tmp"68⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\41D.tmp"C:\Users\Admin\AppData\Local\Temp\41D.tmp"69⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\49A.tmp"C:\Users\Admin\AppData\Local\Temp\49A.tmp"70⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\536.tmp"C:\Users\Admin\AppData\Local\Temp\536.tmp"71⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\5B3.tmp"C:\Users\Admin\AppData\Local\Temp\5B3.tmp"72⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\630.tmp"C:\Users\Admin\AppData\Local\Temp\630.tmp"73⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\6BD.tmp"C:\Users\Admin\AppData\Local\Temp\6BD.tmp"74⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\759.tmp"C:\Users\Admin\AppData\Local\Temp\759.tmp"75⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\7E6.tmp"C:\Users\Admin\AppData\Local\Temp\7E6.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\872.tmp"C:\Users\Admin\AppData\Local\Temp\872.tmp"77⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\8EF.tmp"C:\Users\Admin\AppData\Local\Temp\8EF.tmp"78⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\99B.tmp"C:\Users\Admin\AppData\Local\Temp\99B.tmp"79⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\A18.tmp"C:\Users\Admin\AppData\Local\Temp\A18.tmp"80⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\A95.tmp"C:\Users\Admin\AppData\Local\Temp\A95.tmp"81⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\B12.tmp"C:\Users\Admin\AppData\Local\Temp\B12.tmp"82⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\BAE.tmp"C:\Users\Admin\AppData\Local\Temp\BAE.tmp"83⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\C4B.tmp"C:\Users\Admin\AppData\Local\Temp\C4B.tmp"84⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\CC8.tmp"C:\Users\Admin\AppData\Local\Temp\CC8.tmp"85⤵PID:5704
-
C:\Users\Admin\AppData\Local\Temp\D54.tmp"C:\Users\Admin\AppData\Local\Temp\D54.tmp"86⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\DC2.tmp"C:\Users\Admin\AppData\Local\Temp\DC2.tmp"87⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\E4E.tmp"C:\Users\Admin\AppData\Local\Temp\E4E.tmp"88⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\EEA.tmp"C:\Users\Admin\AppData\Local\Temp\EEA.tmp"89⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\F87.tmp"C:\Users\Admin\AppData\Local\Temp\F87.tmp"90⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\1004.tmp"C:\Users\Admin\AppData\Local\Temp\1004.tmp"91⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\10A0.tmp"C:\Users\Admin\AppData\Local\Temp\10A0.tmp"92⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\114C.tmp"C:\Users\Admin\AppData\Local\Temp\114C.tmp"93⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\11C9.tmp"C:\Users\Admin\AppData\Local\Temp\11C9.tmp"94⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\1246.tmp"C:\Users\Admin\AppData\Local\Temp\1246.tmp"95⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\12B3.tmp"C:\Users\Admin\AppData\Local\Temp\12B3.tmp"96⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\1330.tmp"C:\Users\Admin\AppData\Local\Temp\1330.tmp"97⤵PID:5588
-
C:\Users\Admin\AppData\Local\Temp\13CC.tmp"C:\Users\Admin\AppData\Local\Temp\13CC.tmp"98⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\1459.tmp"C:\Users\Admin\AppData\Local\Temp\1459.tmp"99⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\14C6.tmp"C:\Users\Admin\AppData\Local\Temp\14C6.tmp"100⤵PID:5644
-
C:\Users\Admin\AppData\Local\Temp\1553.tmp"C:\Users\Admin\AppData\Local\Temp\1553.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\15EF.tmp"C:\Users\Admin\AppData\Local\Temp\15EF.tmp"102⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\16AB.tmp"C:\Users\Admin\AppData\Local\Temp\16AB.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\1747.tmp"C:\Users\Admin\AppData\Local\Temp\1747.tmp"104⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\17C4.tmp"C:\Users\Admin\AppData\Local\Temp\17C4.tmp"105⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\1841.tmp"C:\Users\Admin\AppData\Local\Temp\1841.tmp"106⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\18CE.tmp"C:\Users\Admin\AppData\Local\Temp\18CE.tmp"107⤵PID:6048
-
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"108⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\19F7.tmp"C:\Users\Admin\AppData\Local\Temp\19F7.tmp"109⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\1A93.tmp"C:\Users\Admin\AppData\Local\Temp\1A93.tmp"110⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\1B2F.tmp"C:\Users\Admin\AppData\Local\Temp\1B2F.tmp"111⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\1BAC.tmp"C:\Users\Admin\AppData\Local\Temp\1BAC.tmp"112⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\1C39.tmp"C:\Users\Admin\AppData\Local\Temp\1C39.tmp"113⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\1CE5.tmp"C:\Users\Admin\AppData\Local\Temp\1CE5.tmp"114⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\1D71.tmp"C:\Users\Admin\AppData\Local\Temp\1D71.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\1E0D.tmp"C:\Users\Admin\AppData\Local\Temp\1E0D.tmp"116⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"C:\Users\Admin\AppData\Local\Temp\1E8A.tmp"117⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\1F07.tmp"C:\Users\Admin\AppData\Local\Temp\1F07.tmp"118⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\1FF2.tmp"C:\Users\Admin\AppData\Local\Temp\1FF2.tmp"119⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\20BD.tmp"C:\Users\Admin\AppData\Local\Temp\20BD.tmp"120⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\213A.tmp"C:\Users\Admin\AppData\Local\Temp\213A.tmp"121⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\2215.tmp"C:\Users\Admin\AppData\Local\Temp\2215.tmp"122⤵PID:5400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-