Analysis
- max time kernel
117s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 18:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_b4dc0713a677c5eac9db5075e34c8e1b_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_b4dc0713a677c5eac9db5075e34c8e1b_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-09_b4dc0713a677c5eac9db5075e34c8e1b_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample260809-ww794abp2t
- SHA256 ff2e86e67199e7d4074eaabd0372e342351aa8334bc5c353a7d511d36b42a89b
- MD5 b4dc0713a677c5eac9db5075e34c8e1b
- SHA1 dfa3198a83289a70030392ff7ad817107f7f196e
- SHA512 2b99148fd2f55ccb1a54a5f4e3e2ceaa215d8b20fc0f4f6361fb369c35522c026b5637b7db2902714f52f31cd73c119e2b4462416b4bbcf3fcc527ae4c47c485
- SSDEEP 12288:9U5rCOTei6zoJUMAYUGhR+p4GRHbFy/qZoXWjdqpby1grA70G+o:9UQOJ60JJSGhE3H5y/qqGh4yATXo
- TLSH T18CE40121B981C432EAC712704FE2EBB2596ABC75572264C77B80A77E6FB11E19734307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3324 DE31.tmp 1584 DF4A.tmp 3996 E015.tmp 1968 E100.tmp 704 E209.tmp 6004 E2B5.tmp 2508 E390.tmp 5788 E47A.tmp 6108 E545.tmp 2068 E65F.tmp 4636 E71A.tmp 4612 E7E5.tmp 1288 E862.tmp 2260 E8EF.tmp 2692 E97C.tmp 5132 EA08.tmp 2420 EA95.tmp 1272 EB50.tmp 792 EBDD.tmp 2908 EC6A.tmp 1728 ECE7.tmp 2940 ED64.tmp 1576 EE00.tmp 2288 EE8C.tmp 4792 EF19.tmp 2952 EF96.tmp 4764 F032.tmp 1320 F0BF.tmp 3196 F14C.tmp 2352 F1D8.tmp 3432 F246.tmp 3076 F301.tmp 5564 F38E.tmp 5780 F3FB.tmp 1248 F478.tmp 3664 F4E5.tmp 4880 F553.tmp 5472 F5C0.tmp 3872 F63D.tmp 692 F6AB.tmp 5852 F728.tmp 4360 F795.tmp 2432 F822.tmp 2228 F87F.tmp 2536 F8FC.tmp 5664 F96A.tmp 1156 F9D7.tmp 4336 FA54.tmp 4736 FAC1.tmp 3004 FB1F.tmp 204 FBAC.tmp 2188 FC29.tmp 4504 FCA6.tmp 4876 FD32.tmp 3472 FDBF.tmp 4564 FE5B.tmp 292 FEE8.tmp 2156 FF84.tmp 2440 40.tmp 2964 BD.tmp 4948 149.tmp 4068 1C6.tmp 4424 263.tmp 5552 31E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A73E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D737.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3828.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F553.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 277F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 241E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6003.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4998.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F02E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F28F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1394.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ED3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5063.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E71A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 229D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3615.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E88C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4712 wrote to memory of 3324 4712 2026-08-09_b4dc0713a677c5eac9db5075e34c8e1b_elex_mafia_stealc_tofsee.exe 88 PID 3324 wrote to memory of 1584 3324 DE31.tmp 89 PID 1584 wrote to memory of 3996 1584 DF4A.tmp 90 PID 3996 wrote to memory of 1968 3996 E015.tmp 91 PID 1968 wrote to memory of 704 1968 E100.tmp 92 PID 704 wrote to memory of 6004 704 E209.tmp 93 PID 6004 wrote to memory of 2508 6004 E2B5.tmp 94 PID 2508 wrote to memory of 5788 2508 E390.tmp 95 PID 5788 wrote to memory of 6108 5788 E47A.tmp 96 PID 6108 wrote to memory of 2068 6108 E545.tmp 97 PID 2068 wrote to memory of 4636 2068 E65F.tmp 98 PID 4636 wrote to memory of 4612 4636 E71A.tmp 99 PID 4612 wrote to memory of 1288 4612 E7E5.tmp 100 PID 1288 wrote to memory of 2260 1288 E862.tmp 101 PID 2260 wrote to memory of 2692 2260 E8EF.tmp 102 PID 2692 wrote to memory of 5132 2692 E97C.tmp 103 PID 5132 wrote to memory of 2420 5132 EA08.tmp 104 PID 2420 wrote to memory of 1272 2420 EA95.tmp 105 PID 1272 wrote to memory of 792 1272 EB50.tmp 106 PID 792 wrote to memory of 2908 792 EBDD.tmp 107 PID 2908 wrote to memory of 1728 2908 EC6A.tmp 108 PID 1728 wrote to memory of 2940 1728 ECE7.tmp 109 PID 2940 wrote to memory of 1576 2940 ED64.tmp 110 PID 1576 wrote to memory of 2288 1576 EE00.tmp 111 PID 2288 wrote to memory of 4792 2288 EE8C.tmp 112 PID 4792 wrote to memory of 2952 4792 EF19.tmp 113 PID 2952 wrote to memory of 4764 2952 EF96.tmp 114 PID 4764 wrote to memory of 1320 4764 F032.tmp 115 PID 1320 wrote to memory of 3196 1320 F0BF.tmp 116 PID 3196 wrote to memory of 2352 3196 F14C.tmp 117 PID 2352 wrote to memory of 3432 2352 F1D8.tmp 118 PID 3432 wrote to memory of 3076 3432 F246.tmp 119 PID 3076 wrote to memory of 5564 3076 F301.tmp 120 PID 5564 wrote to memory of 5780 5564 F38E.tmp 121 PID 5780 wrote to memory of 1248 5780 F3FB.tmp 122 PID 1248 wrote to memory of 3664 1248 F478.tmp 123 PID 3664 wrote to memory of 4880 3664 F4E5.tmp 124 PID 4880 wrote to memory of 5472 4880 F553.tmp 125 PID 5472 wrote to memory of 3872 5472 F5C0.tmp 126 PID 3872 wrote to memory of 692 3872 F63D.tmp 127 PID 692 wrote to memory of 5852 692 F6AB.tmp 128 PID 5852 wrote to memory of 4360 5852 F728.tmp 129 PID 4360 wrote to memory of 2432 4360 F795.tmp 130 PID 2432 wrote to memory of 2228 2432 F822.tmp 131 PID 2228 wrote to memory of 2536 2228 F87F.tmp 132 PID 2536 wrote to memory of 5664 2536 F8FC.tmp 133 PID 5664 wrote to memory of 1156 5664 F96A.tmp 134 PID 1156 wrote to memory of 4336 1156 F9D7.tmp 135 PID 4336 wrote to memory of 4736 4336 FA54.tmp 136 PID 4736 wrote to memory of 3004 4736 FAC1.tmp 137 PID 3004 wrote to memory of 204 3004 FB1F.tmp 138 PID 204 wrote to memory of 2188 204 FBAC.tmp 139 PID 2188 wrote to memory of 4504 2188 FC29.tmp 140 PID 4504 wrote to memory of 4876 4504 FCA6.tmp 141 PID 4876 wrote to memory of 3472 4876 FD32.tmp 142 PID 3472 wrote to memory of 4564 3472 FDBF.tmp 143 PID 4564 wrote to memory of 292 4564 FE5B.tmp 144 PID 292 wrote to memory of 2156 292 FEE8.tmp 145 PID 2156 wrote to memory of 2440 2156 FF84.tmp 146 PID 2440 wrote to memory of 2964 2440 40.tmp 147 PID 2964 wrote to memory of 4948 2964 BD.tmp 148 PID 4948 wrote to memory of 4068 4948 149.tmp 149 PID 4068 wrote to memory of 4424 4068 1C6.tmp 150 PID 4424 wrote to memory of 5552 4424 263.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_b4dc0713a677c5eac9db5075e34c8e1b_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_b4dc0713a677c5eac9db5075e34c8e1b_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\DE31.tmp"C:\Users\Admin\AppData\Local\Temp\DE31.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\DF4A.tmp"C:\Users\Admin\AppData\Local\Temp\DF4A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\E015.tmp"C:\Users\Admin\AppData\Local\Temp\E015.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\E100.tmp"C:\Users\Admin\AppData\Local\Temp\E100.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\E209.tmp"C:\Users\Admin\AppData\Local\Temp\E209.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\E390.tmp"C:\Users\Admin\AppData\Local\Temp\E390.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\E47A.tmp"C:\Users\Admin\AppData\Local\Temp\E47A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5788 -
C:\Users\Admin\AppData\Local\Temp\E545.tmp"C:\Users\Admin\AppData\Local\Temp\E545.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\E65F.tmp"C:\Users\Admin\AppData\Local\Temp\E65F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\E71A.tmp"C:\Users\Admin\AppData\Local\Temp\E71A.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\E7E5.tmp"C:\Users\Admin\AppData\Local\Temp\E7E5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\E862.tmp"C:\Users\Admin\AppData\Local\Temp\E862.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\E8EF.tmp"C:\Users\Admin\AppData\Local\Temp\E8EF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\E97C.tmp"C:\Users\Admin\AppData\Local\Temp\E97C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\EA08.tmp"C:\Users\Admin\AppData\Local\Temp\EA08.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Users\Admin\AppData\Local\Temp\EA95.tmp"C:\Users\Admin\AppData\Local\Temp\EA95.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\EB50.tmp"C:\Users\Admin\AppData\Local\Temp\EB50.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\EBDD.tmp"C:\Users\Admin\AppData\Local\Temp\EBDD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\EC6A.tmp"C:\Users\Admin\AppData\Local\Temp\EC6A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"C:\Users\Admin\AppData\Local\Temp\ECE7.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\ED64.tmp"C:\Users\Admin\AppData\Local\Temp\ED64.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\EE00.tmp"C:\Users\Admin\AppData\Local\Temp\EE00.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\EF19.tmp"C:\Users\Admin\AppData\Local\Temp\EF19.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\EF96.tmp"C:\Users\Admin\AppData\Local\Temp\EF96.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\F032.tmp"C:\Users\Admin\AppData\Local\Temp\F032.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"C:\Users\Admin\AppData\Local\Temp\F0BF.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\F14C.tmp"C:\Users\Admin\AppData\Local\Temp\F14C.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\F246.tmp"C:\Users\Admin\AppData\Local\Temp\F246.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\F301.tmp"C:\Users\Admin\AppData\Local\Temp\F301.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\F38E.tmp"C:\Users\Admin\AppData\Local\Temp\F38E.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"C:\Users\Admin\AppData\Local\Temp\F3FB.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\F478.tmp"C:\Users\Admin\AppData\Local\Temp\F478.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\F4E5.tmp"C:\Users\Admin\AppData\Local\Temp\F4E5.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\F553.tmp"C:\Users\Admin\AppData\Local\Temp\F553.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\F5C0.tmp"C:\Users\Admin\AppData\Local\Temp\F5C0.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5472 -
C:\Users\Admin\AppData\Local\Temp\F63D.tmp"C:\Users\Admin\AppData\Local\Temp\F63D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"C:\Users\Admin\AppData\Local\Temp\F6AB.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\F728.tmp"C:\Users\Admin\AppData\Local\Temp\F728.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\F795.tmp"C:\Users\Admin\AppData\Local\Temp\F795.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\F822.tmp"C:\Users\Admin\AppData\Local\Temp\F822.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\F87F.tmp"C:\Users\Admin\AppData\Local\Temp\F87F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\F8FC.tmp"C:\Users\Admin\AppData\Local\Temp\F8FC.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\F96A.tmp"C:\Users\Admin\AppData\Local\Temp\F96A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"C:\Users\Admin\AppData\Local\Temp\F9D7.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\FA54.tmp"C:\Users\Admin\AppData\Local\Temp\FA54.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\FAC1.tmp"C:\Users\Admin\AppData\Local\Temp\FAC1.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"C:\Users\Admin\AppData\Local\Temp\FB1F.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\FBAC.tmp"C:\Users\Admin\AppData\Local\Temp\FBAC.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\FC29.tmp"C:\Users\Admin\AppData\Local\Temp\FC29.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\FCA6.tmp"C:\Users\Admin\AppData\Local\Temp\FCA6.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\FD32.tmp"C:\Users\Admin\AppData\Local\Temp\FD32.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\FDBF.tmp"C:\Users\Admin\AppData\Local\Temp\FDBF.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\FE5B.tmp"C:\Users\Admin\AppData\Local\Temp\FE5B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Users\Admin\AppData\Local\Temp\FF84.tmp"C:\Users\Admin\AppData\Local\Temp\FF84.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\40.tmp"C:\Users\Admin\AppData\Local\Temp\40.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\BD.tmp"C:\Users\Admin\AppData\Local\Temp\BD.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\149.tmp"C:\Users\Admin\AppData\Local\Temp\149.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\1C6.tmp"C:\Users\Admin\AppData\Local\Temp\1C6.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\263.tmp"C:\Users\Admin\AppData\Local\Temp\263.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\31E.tmp"C:\Users\Admin\AppData\Local\Temp\31E.tmp"65⤵
- Executes dropped EXE
PID:5552 -
C:\Users\Admin\AppData\Local\Temp\3BA.tmp"C:\Users\Admin\AppData\Local\Temp\3BA.tmp"66⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\457.tmp"C:\Users\Admin\AppData\Local\Temp\457.tmp"67⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\531.tmp"C:\Users\Admin\AppData\Local\Temp\531.tmp"68⤵PID:5504
-
C:\Users\Admin\AppData\Local\Temp\5CE.tmp"C:\Users\Admin\AppData\Local\Temp\5CE.tmp"69⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\66A.tmp"C:\Users\Admin\AppData\Local\Temp\66A.tmp"70⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\6E7.tmp"C:\Users\Admin\AppData\Local\Temp\6E7.tmp"71⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\764.tmp"C:\Users\Admin\AppData\Local\Temp\764.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\800.tmp"C:\Users\Admin\AppData\Local\Temp\800.tmp"73⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\88D.tmp"C:\Users\Admin\AppData\Local\Temp\88D.tmp"74⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\939.tmp"C:\Users\Admin\AppData\Local\Temp\939.tmp"75⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\9E4.tmp"C:\Users\Admin\AppData\Local\Temp\9E4.tmp"76⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\A71.tmp"C:\Users\Admin\AppData\Local\Temp\A71.tmp"77⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\B1D.tmp"C:\Users\Admin\AppData\Local\Temp\B1D.tmp"78⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\BAA.tmp"C:\Users\Admin\AppData\Local\Temp\BAA.tmp"79⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\C46.tmp"C:\Users\Admin\AppData\Local\Temp\C46.tmp"80⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\CE2.tmp"C:\Users\Admin\AppData\Local\Temp\CE2.tmp"81⤵PID:5972
-
C:\Users\Admin\AppData\Local\Temp\D8E.tmp"C:\Users\Admin\AppData\Local\Temp\D8E.tmp"82⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\E0B.tmp"C:\Users\Admin\AppData\Local\Temp\E0B.tmp"83⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\E98.tmp"C:\Users\Admin\AppData\Local\Temp\E98.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\F34.tmp"C:\Users\Admin\AppData\Local\Temp\F34.tmp"85⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\FD0.tmp"C:\Users\Admin\AppData\Local\Temp\FD0.tmp"86⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\105D.tmp"C:\Users\Admin\AppData\Local\Temp\105D.tmp"87⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\10F9.tmp"C:\Users\Admin\AppData\Local\Temp\10F9.tmp"88⤵PID:5708
-
C:\Users\Admin\AppData\Local\Temp\1176.tmp"C:\Users\Admin\AppData\Local\Temp\1176.tmp"89⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\1222.tmp"C:\Users\Admin\AppData\Local\Temp\1222.tmp"90⤵PID:5584
-
C:\Users\Admin\AppData\Local\Temp\12BE.tmp"C:\Users\Admin\AppData\Local\Temp\12BE.tmp"91⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\136A.tmp"C:\Users\Admin\AppData\Local\Temp\136A.tmp"92⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\13F7.tmp"C:\Users\Admin\AppData\Local\Temp\13F7.tmp"93⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\1483.tmp"C:\Users\Admin\AppData\Local\Temp\1483.tmp"94⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\155E.tmp"C:\Users\Admin\AppData\Local\Temp\155E.tmp"95⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\15DB.tmp"C:\Users\Admin\AppData\Local\Temp\15DB.tmp"96⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\1658.tmp"C:\Users\Admin\AppData\Local\Temp\1658.tmp"97⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\16E5.tmp"C:\Users\Admin\AppData\Local\Temp\16E5.tmp"98⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\1790.tmp"C:\Users\Admin\AppData\Local\Temp\1790.tmp"99⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\180D.tmp"C:\Users\Admin\AppData\Local\Temp\180D.tmp"100⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\188A.tmp"C:\Users\Admin\AppData\Local\Temp\188A.tmp"101⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\1946.tmp"C:\Users\Admin\AppData\Local\Temp\1946.tmp"102⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\19E2.tmp"C:\Users\Admin\AppData\Local\Temp\19E2.tmp"103⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\1A7E.tmp"C:\Users\Admin\AppData\Local\Temp\1A7E.tmp"104⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\1B3A.tmp"C:\Users\Admin\AppData\Local\Temp\1B3A.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:5756 -
C:\Users\Admin\AppData\Local\Temp\1C15.tmp"C:\Users\Admin\AppData\Local\Temp\1C15.tmp"106⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"C:\Users\Admin\AppData\Local\Temp\1CE0.tmp"107⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\1D8C.tmp"C:\Users\Admin\AppData\Local\Temp\1D8C.tmp"108⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\1E09.tmp"C:\Users\Admin\AppData\Local\Temp\1E09.tmp"109⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\1EB5.tmp"C:\Users\Admin\AppData\Local\Temp\1EB5.tmp"110⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\1F60.tmp"C:\Users\Admin\AppData\Local\Temp\1F60.tmp"111⤵PID:5208
-
C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"C:\Users\Admin\AppData\Local\Temp\1FDD.tmp"112⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\205A.tmp"C:\Users\Admin\AppData\Local\Temp\205A.tmp"113⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\20D7.tmp"C:\Users\Admin\AppData\Local\Temp\20D7.tmp"114⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\2164.tmp"C:\Users\Admin\AppData\Local\Temp\2164.tmp"115⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\21D1.tmp"C:\Users\Admin\AppData\Local\Temp\21D1.tmp"116⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\229D.tmp"C:\Users\Admin\AppData\Local\Temp\229D.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\2348.tmp"C:\Users\Admin\AppData\Local\Temp\2348.tmp"118⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"119⤵PID:200
-
C:\Users\Admin\AppData\Local\Temp\2442.tmp"C:\Users\Admin\AppData\Local\Temp\2442.tmp"120⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\24FE.tmp"C:\Users\Admin\AppData\Local\Temp\24FE.tmp"121⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"122⤵PID:4536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-