Analysis
- max time kernel
109s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 14:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_4e12cbc90261c850b96c8ef8b009f460_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_4e12cbc90261c850b96c8ef8b009f460_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-09_4e12cbc90261c850b96c8ef8b009f460_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260809-rsca2asxds
- SHA256 1e73145a2c8903aa387df5db618f29cfc678a46c323ca471c6d2d560b7a79983
- MD5 4e12cbc90261c850b96c8ef8b009f460
- SHA1 719764e818f086a480c70825f23753b044131a46
- SHA512 b94b655346f9bba32d8bcd02927c182c9bb0b8b46c50291967061d1aa8dc066140e7c09936e9d3fcbf6cd840ea5f7ebd58aa2f672ffee518db41948587e04a47
- SSDEEP 12288:NU5rCOTeijel6568eQ2KJfLQ1uh5lOQCTZwlH:NUQOJjelV+2K21uglTSlH
- TLSH T1DAB4F126B184C533E99202710AE6EBB1693ABC71172694C77B90A37E2FB07E1D375347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4928 DECD.tmp 4356 DFA8.tmp 3276 E035.tmp 4352 E100.tmp 1476 E17D.tmp 2448 E229.tmp 1244 E303.tmp 5860 E3CE.tmp 4432 E4C8.tmp 4592 E565.tmp 4976 E5E2.tmp 5716 E67E.tmp 2584 E6FB.tmp 3448 E7C6.tmp 5460 E872.tmp 364 E8FF.tmp 4200 E9F9.tmp 2412 EAB4.tmp 4992 EB41.tmp 3972 EBDD.tmp 2948 EC89.tmp 5660 ED25.tmp 5220 EDE1.tmp 4448 EE8C.tmp 5544 EF09.tmp 3212 EFD5.tmp 5444 F080.tmp 4596 F13C.tmp 5936 F1E8.tmp 5168 F284.tmp 2224 F320.tmp 2580 F3BD.tmp 796 F449.tmp 5948 F4B7.tmp 2712 F543.tmp 1100 F5C0.tmp 5588 F66C.tmp 5896 F6F9.tmp 5284 F785.tmp 1620 F7F3.tmp 2852 F870.tmp 3196 F91C.tmp 1140 F999.tmp 5792 FA44.tmp 5656 FAC1.tmp 2844 FB3E.tmp 3844 FBCB.tmp 1284 FC77.tmp 1588 FD04.tmp 1076 FD90.tmp 5336 FE0D.tmp 2068 FE9A.tmp 1516 FF26.tmp 5804 FFA3.tmp 2576 11.tmp 4864 9D.tmp 2504 13A.tmp 4404 1E6.tmp 2092 253.tmp 3244 2E0.tmp 4332 36C.tmp 5892 3F9.tmp 3888 4B4.tmp 5664 531.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F696.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 439D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F080.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8307.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6217.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4320.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5020.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E565.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A058.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C219.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8761.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E773.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E291.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4504.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5620.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6294.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C95C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E58F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF26.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3632 wrote to memory of 4928 3632 2026-08-09_4e12cbc90261c850b96c8ef8b009f460_elex_mafia_stealc_tofsee.exe 88 PID 4928 wrote to memory of 4356 4928 DECD.tmp 89 PID 4356 wrote to memory of 3276 4356 DFA8.tmp 90 PID 3276 wrote to memory of 4352 3276 E035.tmp 91 PID 4352 wrote to memory of 1476 4352 E100.tmp 92 PID 1476 wrote to memory of 2448 1476 E17D.tmp 93 PID 2448 wrote to memory of 1244 2448 E229.tmp 94 PID 1244 wrote to memory of 5860 1244 E303.tmp 95 PID 5860 wrote to memory of 4432 5860 E3CE.tmp 96 PID 4432 wrote to memory of 4592 4432 E4C8.tmp 97 PID 4592 wrote to memory of 4976 4592 E565.tmp 98 PID 4976 wrote to memory of 5716 4976 E5E2.tmp 99 PID 5716 wrote to memory of 2584 5716 E67E.tmp 100 PID 2584 wrote to memory of 3448 2584 E6FB.tmp 101 PID 3448 wrote to memory of 5460 3448 E7C6.tmp 102 PID 5460 wrote to memory of 364 5460 E872.tmp 103 PID 364 wrote to memory of 4200 364 E8FF.tmp 104 PID 4200 wrote to memory of 2412 4200 E9F9.tmp 105 PID 2412 wrote to memory of 4992 2412 EAB4.tmp 106 PID 4992 wrote to memory of 3972 4992 EB41.tmp 107 PID 3972 wrote to memory of 2948 3972 EBDD.tmp 108 PID 2948 wrote to memory of 5660 2948 EC89.tmp 109 PID 5660 wrote to memory of 5220 5660 ED25.tmp 110 PID 5220 wrote to memory of 4448 5220 EDE1.tmp 111 PID 4448 wrote to memory of 5544 4448 EE8C.tmp 112 PID 5544 wrote to memory of 3212 5544 EF09.tmp 113 PID 3212 wrote to memory of 5444 3212 EFD5.tmp 114 PID 5444 wrote to memory of 4596 5444 F080.tmp 115 PID 4596 wrote to memory of 5936 4596 F13C.tmp 116 PID 5936 wrote to memory of 5168 5936 F1E8.tmp 117 PID 5168 wrote to memory of 2224 5168 F284.tmp 118 PID 2224 wrote to memory of 2580 2224 F320.tmp 119 PID 2580 wrote to memory of 796 2580 F3BD.tmp 120 PID 796 wrote to memory of 5948 796 F449.tmp 121 PID 5948 wrote to memory of 2712 5948 F4B7.tmp 122 PID 2712 wrote to memory of 1100 2712 F543.tmp 123 PID 1100 wrote to memory of 5588 1100 F5C0.tmp 124 PID 5588 wrote to memory of 5896 5588 F66C.tmp 125 PID 5896 wrote to memory of 5284 5896 F6F9.tmp 126 PID 5284 wrote to memory of 1620 5284 F785.tmp 127 PID 1620 wrote to memory of 2852 1620 F7F3.tmp 128 PID 2852 wrote to memory of 3196 2852 F870.tmp 129 PID 3196 wrote to memory of 1140 3196 F91C.tmp 130 PID 1140 wrote to memory of 5792 1140 F999.tmp 131 PID 5792 wrote to memory of 5656 5792 FA44.tmp 132 PID 5656 wrote to memory of 2844 5656 FAC1.tmp 133 PID 2844 wrote to memory of 3844 2844 FB3E.tmp 134 PID 3844 wrote to memory of 1284 3844 FBCB.tmp 135 PID 1284 wrote to memory of 1588 1284 FC77.tmp 136 PID 1588 wrote to memory of 1076 1588 FD04.tmp 137 PID 1076 wrote to memory of 5336 1076 FD90.tmp 138 PID 5336 wrote to memory of 2068 5336 FE0D.tmp 139 PID 2068 wrote to memory of 1516 2068 FE9A.tmp 140 PID 1516 wrote to memory of 5804 1516 FF26.tmp 141 PID 5804 wrote to memory of 2576 5804 FFA3.tmp 142 PID 2576 wrote to memory of 4864 2576 11.tmp 143 PID 4864 wrote to memory of 2504 4864 9D.tmp 144 PID 2504 wrote to memory of 4404 2504 13A.tmp 145 PID 4404 wrote to memory of 2092 4404 1E6.tmp 146 PID 2092 wrote to memory of 3244 2092 253.tmp 147 PID 3244 wrote to memory of 4332 3244 2E0.tmp 148 PID 4332 wrote to memory of 5892 4332 36C.tmp 149 PID 5892 wrote to memory of 3888 5892 3F9.tmp 150 PID 3888 wrote to memory of 5664 3888 4B4.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_4e12cbc90261c850b96c8ef8b009f460_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_4e12cbc90261c850b96c8ef8b009f460_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\DECD.tmp"C:\Users\Admin\AppData\Local\Temp\DECD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\DFA8.tmp"C:\Users\Admin\AppData\Local\Temp\DFA8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\E035.tmp"C:\Users\Admin\AppData\Local\Temp\E035.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\E100.tmp"C:\Users\Admin\AppData\Local\Temp\E100.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\E17D.tmp"C:\Users\Admin\AppData\Local\Temp\E17D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\E229.tmp"C:\Users\Admin\AppData\Local\Temp\E229.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\E303.tmp"C:\Users\Admin\AppData\Local\Temp\E303.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\E3CE.tmp"C:\Users\Admin\AppData\Local\Temp\E3CE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"C:\Users\Admin\AppData\Local\Temp\E4C8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\E565.tmp"C:\Users\Admin\AppData\Local\Temp\E565.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\E5E2.tmp"C:\Users\Admin\AppData\Local\Temp\E5E2.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\E67E.tmp"C:\Users\Admin\AppData\Local\Temp\E67E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\E6FB.tmp"C:\Users\Admin\AppData\Local\Temp\E6FB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\E7C6.tmp"C:\Users\Admin\AppData\Local\Temp\E7C6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\E872.tmp"C:\Users\Admin\AppData\Local\Temp\E872.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5460 -
C:\Users\Admin\AppData\Local\Temp\E8FF.tmp"C:\Users\Admin\AppData\Local\Temp\E8FF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\E9F9.tmp"C:\Users\Admin\AppData\Local\Temp\E9F9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"C:\Users\Admin\AppData\Local\Temp\EAB4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\EB41.tmp"C:\Users\Admin\AppData\Local\Temp\EB41.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\EBDD.tmp"C:\Users\Admin\AppData\Local\Temp\EBDD.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\EC89.tmp"C:\Users\Admin\AppData\Local\Temp\EC89.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\ED25.tmp"C:\Users\Admin\AppData\Local\Temp\ED25.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Users\Admin\AppData\Local\Temp\EDE1.tmp"C:\Users\Admin\AppData\Local\Temp\EDE1.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\EF09.tmp"C:\Users\Admin\AppData\Local\Temp\EF09.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"C:\Users\Admin\AppData\Local\Temp\EFD5.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\F080.tmp"C:\Users\Admin\AppData\Local\Temp\F080.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5444 -
C:\Users\Admin\AppData\Local\Temp\F13C.tmp"C:\Users\Admin\AppData\Local\Temp\F13C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"C:\Users\Admin\AppData\Local\Temp\F1E8.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\F284.tmp"C:\Users\Admin\AppData\Local\Temp\F284.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Users\Admin\AppData\Local\Temp\F320.tmp"C:\Users\Admin\AppData\Local\Temp\F320.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"C:\Users\Admin\AppData\Local\Temp\F3BD.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\F449.tmp"C:\Users\Admin\AppData\Local\Temp\F449.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\F4B7.tmp"C:\Users\Admin\AppData\Local\Temp\F4B7.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\F543.tmp"C:\Users\Admin\AppData\Local\Temp\F543.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\F5C0.tmp"C:\Users\Admin\AppData\Local\Temp\F5C0.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\F66C.tmp"C:\Users\Admin\AppData\Local\Temp\F66C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"C:\Users\Admin\AppData\Local\Temp\F6F9.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\F785.tmp"C:\Users\Admin\AppData\Local\Temp\F785.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\F870.tmp"C:\Users\Admin\AppData\Local\Temp\F870.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\F91C.tmp"C:\Users\Admin\AppData\Local\Temp\F91C.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\F999.tmp"C:\Users\Admin\AppData\Local\Temp\F999.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\FA44.tmp"C:\Users\Admin\AppData\Local\Temp\FA44.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\FAC1.tmp"C:\Users\Admin\AppData\Local\Temp\FAC1.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\FBCB.tmp"C:\Users\Admin\AppData\Local\Temp\FBCB.tmp"48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\FC77.tmp"C:\Users\Admin\AppData\Local\Temp\FC77.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\FD04.tmp"C:\Users\Admin\AppData\Local\Temp\FD04.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\FD90.tmp"C:\Users\Admin\AppData\Local\Temp\FD90.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\FE0D.tmp"C:\Users\Admin\AppData\Local\Temp\FE0D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5336 -
C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\FF26.tmp"C:\Users\Admin\AppData\Local\Temp\FF26.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5804 -
C:\Users\Admin\AppData\Local\Temp\11.tmp"C:\Users\Admin\AppData\Local\Temp\11.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\9D.tmp"C:\Users\Admin\AppData\Local\Temp\9D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\13A.tmp"C:\Users\Admin\AppData\Local\Temp\13A.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\1E6.tmp"C:\Users\Admin\AppData\Local\Temp\1E6.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\253.tmp"C:\Users\Admin\AppData\Local\Temp\253.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\2E0.tmp"C:\Users\Admin\AppData\Local\Temp\2E0.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\36C.tmp"C:\Users\Admin\AppData\Local\Temp\36C.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\3F9.tmp"C:\Users\Admin\AppData\Local\Temp\3F9.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\4B4.tmp"C:\Users\Admin\AppData\Local\Temp\4B4.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\531.tmp"C:\Users\Admin\AppData\Local\Temp\531.tmp"65⤵
- Executes dropped EXE
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\5CE.tmp"C:\Users\Admin\AppData\Local\Temp\5CE.tmp"66⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\64B.tmp"C:\Users\Admin\AppData\Local\Temp\64B.tmp"67⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\6D7.tmp"C:\Users\Admin\AppData\Local\Temp\6D7.tmp"68⤵PID:5592
-
C:\Users\Admin\AppData\Local\Temp\754.tmp"C:\Users\Admin\AppData\Local\Temp\754.tmp"69⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\7E1.tmp"C:\Users\Admin\AppData\Local\Temp\7E1.tmp"70⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\86D.tmp"C:\Users\Admin\AppData\Local\Temp\86D.tmp"71⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\8FA.tmp"C:\Users\Admin\AppData\Local\Temp\8FA.tmp"72⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\977.tmp"C:\Users\Admin\AppData\Local\Temp\977.tmp"73⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\9E4.tmp"C:\Users\Admin\AppData\Local\Temp\9E4.tmp"74⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\A52.tmp"C:\Users\Admin\AppData\Local\Temp\A52.tmp"75⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\ACF.tmp"C:\Users\Admin\AppData\Local\Temp\ACF.tmp"76⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\B6B.tmp"C:\Users\Admin\AppData\Local\Temp\B6B.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\BF8.tmp"C:\Users\Admin\AppData\Local\Temp\BF8.tmp"78⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\C84.tmp"C:\Users\Admin\AppData\Local\Temp\C84.tmp"79⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\D11.tmp"C:\Users\Admin\AppData\Local\Temp\D11.tmp"80⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\D7E.tmp"C:\Users\Admin\AppData\Local\Temp\D7E.tmp"81⤵PID:5340
-
C:\Users\Admin\AppData\Local\Temp\DFB.tmp"C:\Users\Admin\AppData\Local\Temp\DFB.tmp"82⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\E78.tmp"C:\Users\Admin\AppData\Local\Temp\E78.tmp"83⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\EE6.tmp"C:\Users\Admin\AppData\Local\Temp\EE6.tmp"84⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\F92.tmp"C:\Users\Admin\AppData\Local\Temp\F92.tmp"85⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\100F.tmp"C:\Users\Admin\AppData\Local\Temp\100F.tmp"86⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\10AB.tmp"C:\Users\Admin\AppData\Local\Temp\10AB.tmp"87⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\1109.tmp"C:\Users\Admin\AppData\Local\Temp\1109.tmp"88⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\1176.tmp"C:\Users\Admin\AppData\Local\Temp\1176.tmp"89⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\1203.tmp"C:\Users\Admin\AppData\Local\Temp\1203.tmp"90⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\1280.tmp"C:\Users\Admin\AppData\Local\Temp\1280.tmp"91⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\130C.tmp"C:\Users\Admin\AppData\Local\Temp\130C.tmp"92⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\13B8.tmp"C:\Users\Admin\AppData\Local\Temp\13B8.tmp"93⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\1454.tmp"C:\Users\Admin\AppData\Local\Temp\1454.tmp"94⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\14D1.tmp"C:\Users\Admin\AppData\Local\Temp\14D1.tmp"95⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\155E.tmp"C:\Users\Admin\AppData\Local\Temp\155E.tmp"96⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\15FA.tmp"C:\Users\Admin\AppData\Local\Temp\15FA.tmp"97⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\16B6.tmp"C:\Users\Admin\AppData\Local\Temp\16B6.tmp"98⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\1733.tmp"C:\Users\Admin\AppData\Local\Temp\1733.tmp"99⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\17BF.tmp"C:\Users\Admin\AppData\Local\Temp\17BF.tmp"100⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\182D.tmp"C:\Users\Admin\AppData\Local\Temp\182D.tmp"101⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\18AA.tmp"C:\Users\Admin\AppData\Local\Temp\18AA.tmp"102⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\1946.tmp"C:\Users\Admin\AppData\Local\Temp\1946.tmp"103⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\19D3.tmp"C:\Users\Admin\AppData\Local\Temp\19D3.tmp"104⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\1A5F.tmp"C:\Users\Admin\AppData\Local\Temp\1A5F.tmp"105⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\1AEC.tmp"C:\Users\Admin\AppData\Local\Temp\1AEC.tmp"106⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\1B88.tmp"C:\Users\Admin\AppData\Local\Temp\1B88.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\1C15.tmp"C:\Users\Admin\AppData\Local\Temp\1C15.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\1CB1.tmp"C:\Users\Admin\AppData\Local\Temp\1CB1.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\1D2E.tmp"C:\Users\Admin\AppData\Local\Temp\1D2E.tmp"110⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\1DBB.tmp"C:\Users\Admin\AppData\Local\Temp\1DBB.tmp"111⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\1E57.tmp"C:\Users\Admin\AppData\Local\Temp\1E57.tmp"112⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\1EB5.tmp"C:\Users\Admin\AppData\Local\Temp\1EB5.tmp"113⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\1F41.tmp"C:\Users\Admin\AppData\Local\Temp\1F41.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:5132 -
C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"115⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\205A.tmp"C:\Users\Admin\AppData\Local\Temp\205A.tmp"116⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\20D7.tmp"C:\Users\Admin\AppData\Local\Temp\20D7.tmp"117⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\2164.tmp"C:\Users\Admin\AppData\Local\Temp\2164.tmp"118⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\21D1.tmp"C:\Users\Admin\AppData\Local\Temp\21D1.tmp"119⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\224E.tmp"C:\Users\Admin\AppData\Local\Temp\224E.tmp"120⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\22EB.tmp"C:\Users\Admin\AppData\Local\Temp\22EB.tmp"121⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\2358.tmp"C:\Users\Admin\AppData\Local\Temp\2358.tmp"122⤵PID:3576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-