Analysis
- max time kernel
115s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 09:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_9fa1f3d7cf08a7b6fa8794f711c3dca9_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_9fa1f3d7cf08a7b6fa8794f711c3dca9_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-10_9fa1f3d7cf08a7b6fa8794f711c3dca9_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260810-lw87aafc92
- SHA256 73c83ac8ae5da1ba916327cb4435912a91aede7f56da4a156c38d6d7efa545c6
- MD5 9fa1f3d7cf08a7b6fa8794f711c3dca9
- SHA1 ee4fce27a71dae7a3d941c2bf2234b7e71853fe8
- SHA512 93e29bfed1b90c89628998bac310373f01088ff537d00a7df73aff25e8aa448d02900414d190341b2e2ec6c7490dab4c306a526ffaaa42b5b629dd3e8e2ffb03
- SSDEEP 12288:NU5rCOTeijxfr/62vLcE1Eympo/fxTZwlH:NUQOJjxT/64LGyB/fxTSlH
- TLSH T101B4F025B284C132E6D212704AE6EBB26E3B7C75573594C72B80A67E2FB16E1D375303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3452 EA95.tmp 3464 EB50.tmp 2136 EBCD.tmp 5960 EC89.tmp 1088 ED25.tmp 3164 EE0F.tmp 2360 EE8C.tmp 5880 EF38.tmp 5416 EFE4.tmp 4696 F0A0.tmp 1044 F13C.tmp 2640 F236.tmp 4548 F301.tmp 4112 F37E.tmp 252 F40B.tmp 3924 F4A7.tmp 4952 F534.tmp 2196 F5B1.tmp 5180 F65C.tmp 2132 F6E9.tmp 3952 F776.tmp 3340 F7F3.tmp 3124 F8BE.tmp 4040 F95A.tmp 1492 F9F6.tmp 4964 FA83.tmp 1888 FB4E.tmp 2948 FBFA.tmp 3840 FCD5.tmp 824 FD61.tmp 2768 FDFE.tmp 3944 FEB9.tmp 3880 FF75.tmp 5356 FFF2.tmp 1688 7E.tmp 1616 EC.tmp 2096 188.tmp 2972 205.tmp 2160 2A1.tmp 5824 34D.tmp 1976 3E9.tmp 4536 476.tmp 2700 522.tmp 4812 5CE.tmp 3700 64B.tmp 2500 6D7.tmp 4248 754.tmp 484 7E1.tmp 5372 86D.tmp 4412 8FA.tmp 1856 987.tmp 4664 9F4.tmp 3140 A71.tmp 936 AEE.tmp 4340 BAA.tmp 1120 C27.tmp 5760 CB3.tmp 4384 D4F.tmp 4512 DEC.tmp 4864 E59.tmp 2584 ED6.tmp 2672 F72.tmp 2712 100F.tmp 4104 108C.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 609B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2646.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 150B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3303.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3564.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 602D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3370.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9835.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1389.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F781.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 522.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8435.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F54E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6464.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E54.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A303.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 148E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2934.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 616B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8212.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5853.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C303.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3852.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6379.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6761.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD5D.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2440 wrote to memory of 3452 2440 2026-08-10_9fa1f3d7cf08a7b6fa8794f711c3dca9_elex_mafia_stealc_tofsee.exe 88 PID 3452 wrote to memory of 3464 3452 EA95.tmp 90 PID 3464 wrote to memory of 2136 3464 EB50.tmp 91 PID 2136 wrote to memory of 5960 2136 EBCD.tmp 92 PID 5960 wrote to memory of 1088 5960 EC89.tmp 93 PID 1088 wrote to memory of 3164 1088 ED25.tmp 94 PID 3164 wrote to memory of 2360 3164 EE0F.tmp 95 PID 2360 wrote to memory of 5880 2360 EE8C.tmp 96 PID 5880 wrote to memory of 5416 5880 EF38.tmp 97 PID 5416 wrote to memory of 4696 5416 EFE4.tmp 98 PID 4696 wrote to memory of 1044 4696 F0A0.tmp 99 PID 1044 wrote to memory of 2640 1044 F13C.tmp 100 PID 2640 wrote to memory of 4548 2640 F236.tmp 101 PID 4548 wrote to memory of 4112 4548 F301.tmp 102 PID 4112 wrote to memory of 252 4112 F37E.tmp 103 PID 252 wrote to memory of 3924 252 F40B.tmp 104 PID 3924 wrote to memory of 4952 3924 F4A7.tmp 105 PID 4952 wrote to memory of 2196 4952 F534.tmp 106 PID 2196 wrote to memory of 5180 2196 F5B1.tmp 107 PID 5180 wrote to memory of 2132 5180 F65C.tmp 108 PID 2132 wrote to memory of 3952 2132 F6E9.tmp 109 PID 3952 wrote to memory of 3340 3952 F776.tmp 110 PID 3340 wrote to memory of 3124 3340 F7F3.tmp 111 PID 3124 wrote to memory of 4040 3124 F8BE.tmp 112 PID 4040 wrote to memory of 1492 4040 F95A.tmp 113 PID 1492 wrote to memory of 4964 1492 F9F6.tmp 114 PID 4964 wrote to memory of 1888 4964 FA83.tmp 115 PID 1888 wrote to memory of 2948 1888 FB4E.tmp 116 PID 2948 wrote to memory of 3840 2948 FBFA.tmp 117 PID 3840 wrote to memory of 824 3840 FCD5.tmp 118 PID 824 wrote to memory of 2768 824 FD61.tmp 119 PID 2768 wrote to memory of 3944 2768 FDFE.tmp 120 PID 3944 wrote to memory of 3880 3944 FEB9.tmp 121 PID 3880 wrote to memory of 5356 3880 FF75.tmp 122 PID 5356 wrote to memory of 1688 5356 FFF2.tmp 123 PID 1688 wrote to memory of 1616 1688 7E.tmp 124 PID 1616 wrote to memory of 2096 1616 EC.tmp 125 PID 2096 wrote to memory of 2972 2096 188.tmp 126 PID 2972 wrote to memory of 2160 2972 205.tmp 127 PID 2160 wrote to memory of 5824 2160 2A1.tmp 128 PID 5824 wrote to memory of 1976 5824 34D.tmp 129 PID 1976 wrote to memory of 4536 1976 3E9.tmp 130 PID 4536 wrote to memory of 2700 4536 476.tmp 131 PID 2700 wrote to memory of 4812 2700 522.tmp 132 PID 4812 wrote to memory of 3700 4812 5CE.tmp 133 PID 3700 wrote to memory of 2500 3700 64B.tmp 134 PID 2500 wrote to memory of 4248 2500 6D7.tmp 135 PID 4248 wrote to memory of 484 4248 754.tmp 136 PID 484 wrote to memory of 5372 484 7E1.tmp 137 PID 5372 wrote to memory of 4412 5372 86D.tmp 138 PID 4412 wrote to memory of 1856 4412 8FA.tmp 139 PID 1856 wrote to memory of 4664 1856 987.tmp 140 PID 4664 wrote to memory of 3140 4664 9F4.tmp 141 PID 3140 wrote to memory of 936 3140 A71.tmp 142 PID 936 wrote to memory of 4340 936 AEE.tmp 143 PID 4340 wrote to memory of 1120 4340 BAA.tmp 144 PID 1120 wrote to memory of 5760 1120 C27.tmp 145 PID 5760 wrote to memory of 4384 5760 CB3.tmp 146 PID 4384 wrote to memory of 4512 4384 D4F.tmp 147 PID 4512 wrote to memory of 4864 4512 DEC.tmp 148 PID 4864 wrote to memory of 2584 4864 E59.tmp 149 PID 2584 wrote to memory of 2672 2584 ED6.tmp 150 PID 2672 wrote to memory of 2712 2672 F72.tmp 151 PID 2712 wrote to memory of 4104 2712 100F.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_9fa1f3d7cf08a7b6fa8794f711c3dca9_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_9fa1f3d7cf08a7b6fa8794f711c3dca9_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\EA95.tmp"C:\Users\Admin\AppData\Local\Temp\EA95.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\EB50.tmp"C:\Users\Admin\AppData\Local\Temp\EB50.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\EBCD.tmp"C:\Users\Admin\AppData\Local\Temp\EBCD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\EC89.tmp"C:\Users\Admin\AppData\Local\Temp\EC89.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\ED25.tmp"C:\Users\Admin\AppData\Local\Temp\ED25.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\EE0F.tmp"C:\Users\Admin\AppData\Local\Temp\EE0F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"C:\Users\Admin\AppData\Local\Temp\EE8C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\EF38.tmp"C:\Users\Admin\AppData\Local\Temp\EF38.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\EFE4.tmp"C:\Users\Admin\AppData\Local\Temp\EFE4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"C:\Users\Admin\AppData\Local\Temp\F0A0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\F13C.tmp"C:\Users\Admin\AppData\Local\Temp\F13C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\F236.tmp"C:\Users\Admin\AppData\Local\Temp\F236.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\F301.tmp"C:\Users\Admin\AppData\Local\Temp\F301.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\F37E.tmp"C:\Users\Admin\AppData\Local\Temp\F37E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\F40B.tmp"C:\Users\Admin\AppData\Local\Temp\F40B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"C:\Users\Admin\AppData\Local\Temp\F4A7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\F534.tmp"C:\Users\Admin\AppData\Local\Temp\F534.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\F5B1.tmp"C:\Users\Admin\AppData\Local\Temp\F5B1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\F65C.tmp"C:\Users\Admin\AppData\Local\Temp\F65C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\F6E9.tmp"C:\Users\Admin\AppData\Local\Temp\F6E9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\F776.tmp"C:\Users\Admin\AppData\Local\Temp\F776.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"C:\Users\Admin\AppData\Local\Temp\F7F3.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"C:\Users\Admin\AppData\Local\Temp\F8BE.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\F95A.tmp"C:\Users\Admin\AppData\Local\Temp\F95A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\F9F6.tmp"C:\Users\Admin\AppData\Local\Temp\F9F6.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\FA83.tmp"C:\Users\Admin\AppData\Local\Temp\FA83.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\FB4E.tmp"C:\Users\Admin\AppData\Local\Temp\FB4E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\FBFA.tmp"C:\Users\Admin\AppData\Local\Temp\FBFA.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\FCD5.tmp"C:\Users\Admin\AppData\Local\Temp\FCD5.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\FD61.tmp"C:\Users\Admin\AppData\Local\Temp\FD61.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\FF75.tmp"C:\Users\Admin\AppData\Local\Temp\FF75.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\FFF2.tmp"C:\Users\Admin\AppData\Local\Temp\FFF2.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\7E.tmp"C:\Users\Admin\AppData\Local\Temp\7E.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\EC.tmp"C:\Users\Admin\AppData\Local\Temp\EC.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\188.tmp"C:\Users\Admin\AppData\Local\Temp\188.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\205.tmp"C:\Users\Admin\AppData\Local\Temp\205.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\2A1.tmp"C:\Users\Admin\AppData\Local\Temp\2A1.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\34D.tmp"C:\Users\Admin\AppData\Local\Temp\34D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\3E9.tmp"C:\Users\Admin\AppData\Local\Temp\3E9.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\476.tmp"C:\Users\Admin\AppData\Local\Temp\476.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\522.tmp"C:\Users\Admin\AppData\Local\Temp\522.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\5CE.tmp"C:\Users\Admin\AppData\Local\Temp\5CE.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\64B.tmp"C:\Users\Admin\AppData\Local\Temp\64B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\6D7.tmp"C:\Users\Admin\AppData\Local\Temp\6D7.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\754.tmp"C:\Users\Admin\AppData\Local\Temp\754.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\7E1.tmp"C:\Users\Admin\AppData\Local\Temp\7E1.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\86D.tmp"C:\Users\Admin\AppData\Local\Temp\86D.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\8FA.tmp"C:\Users\Admin\AppData\Local\Temp\8FA.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\987.tmp"C:\Users\Admin\AppData\Local\Temp\987.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\9F4.tmp"C:\Users\Admin\AppData\Local\Temp\9F4.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\A71.tmp"C:\Users\Admin\AppData\Local\Temp\A71.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\AEE.tmp"C:\Users\Admin\AppData\Local\Temp\AEE.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\BAA.tmp"C:\Users\Admin\AppData\Local\Temp\BAA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\C27.tmp"C:\Users\Admin\AppData\Local\Temp\C27.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\CB3.tmp"C:\Users\Admin\AppData\Local\Temp\CB3.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Users\Admin\AppData\Local\Temp\D4F.tmp"C:\Users\Admin\AppData\Local\Temp\D4F.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\DEC.tmp"C:\Users\Admin\AppData\Local\Temp\DEC.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\E59.tmp"C:\Users\Admin\AppData\Local\Temp\E59.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\ED6.tmp"C:\Users\Admin\AppData\Local\Temp\ED6.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\F72.tmp"C:\Users\Admin\AppData\Local\Temp\F72.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\100F.tmp"C:\Users\Admin\AppData\Local\Temp\100F.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\108C.tmp"C:\Users\Admin\AppData\Local\Temp\108C.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\1118.tmp"C:\Users\Admin\AppData\Local\Temp\1118.tmp"66⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\11D4.tmp"C:\Users\Admin\AppData\Local\Temp\11D4.tmp"67⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\1260.tmp"C:\Users\Admin\AppData\Local\Temp\1260.tmp"68⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\12DD.tmp"C:\Users\Admin\AppData\Local\Temp\12DD.tmp"69⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\1389.tmp"C:\Users\Admin\AppData\Local\Temp\1389.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\1416.tmp"C:\Users\Admin\AppData\Local\Temp\1416.tmp"71⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\14A2.tmp"C:\Users\Admin\AppData\Local\Temp\14A2.tmp"72⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\152F.tmp"C:\Users\Admin\AppData\Local\Temp\152F.tmp"73⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\15DB.tmp"C:\Users\Admin\AppData\Local\Temp\15DB.tmp"74⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\1668.tmp"C:\Users\Admin\AppData\Local\Temp\1668.tmp"75⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\16E5.tmp"C:\Users\Admin\AppData\Local\Temp\16E5.tmp"76⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\1790.tmp"C:\Users\Admin\AppData\Local\Temp\1790.tmp"77⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\180D.tmp"C:\Users\Admin\AppData\Local\Temp\180D.tmp"78⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\189A.tmp"C:\Users\Admin\AppData\Local\Temp\189A.tmp"79⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\1936.tmp"C:\Users\Admin\AppData\Local\Temp\1936.tmp"80⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\19B3.tmp"C:\Users\Admin\AppData\Local\Temp\19B3.tmp"81⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\1A30.tmp"C:\Users\Admin\AppData\Local\Temp\1A30.tmp"82⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\1AAD.tmp"C:\Users\Admin\AppData\Local\Temp\1AAD.tmp"83⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\1B59.tmp"C:\Users\Admin\AppData\Local\Temp\1B59.tmp"84⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"C:\Users\Admin\AppData\Local\Temp\1BE6.tmp"85⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\1C72.tmp"C:\Users\Admin\AppData\Local\Temp\1C72.tmp"86⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\1CFF.tmp"C:\Users\Admin\AppData\Local\Temp\1CFF.tmp"87⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\1D9B.tmp"C:\Users\Admin\AppData\Local\Temp\1D9B.tmp"88⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\1E38.tmp"C:\Users\Admin\AppData\Local\Temp\1E38.tmp"89⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"C:\Users\Admin\AppData\Local\Temp\1EA5.tmp"90⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\1F51.tmp"C:\Users\Admin\AppData\Local\Temp\1F51.tmp"91⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\1FED.tmp"C:\Users\Admin\AppData\Local\Temp\1FED.tmp"92⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\2089.tmp"C:\Users\Admin\AppData\Local\Temp\2089.tmp"93⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\2116.tmp"C:\Users\Admin\AppData\Local\Temp\2116.tmp"94⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\21B2.tmp"C:\Users\Admin\AppData\Local\Temp\21B2.tmp"95⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\223F.tmp"C:\Users\Admin\AppData\Local\Temp\223F.tmp"96⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\22CB.tmp"C:\Users\Admin\AppData\Local\Temp\22CB.tmp"97⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\2348.tmp"C:\Users\Admin\AppData\Local\Temp\2348.tmp"98⤵PID:5772
-
C:\Users\Admin\AppData\Local\Temp\23C5.tmp"C:\Users\Admin\AppData\Local\Temp\23C5.tmp"99⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\2462.tmp"C:\Users\Admin\AppData\Local\Temp\2462.tmp"100⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"101⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"102⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"103⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\26C3.tmp"C:\Users\Admin\AppData\Local\Temp\26C3.tmp"105⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\2750.tmp"C:\Users\Admin\AppData\Local\Temp\2750.tmp"106⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\27EC.tmp"C:\Users\Admin\AppData\Local\Temp\27EC.tmp"107⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\28B7.tmp"C:\Users\Admin\AppData\Local\Temp\28B7.tmp"108⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\2934.tmp"C:\Users\Admin\AppData\Local\Temp\2934.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:5640 -
C:\Users\Admin\AppData\Local\Temp\29C1.tmp"C:\Users\Admin\AppData\Local\Temp\29C1.tmp"110⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"C:\Users\Admin\AppData\Local\Temp\2A3E.tmp"111⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\2ADA.tmp"C:\Users\Admin\AppData\Local\Temp\2ADA.tmp"112⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2B47.tmp"C:\Users\Admin\AppData\Local\Temp\2B47.tmp"113⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\2BD4.tmp"C:\Users\Admin\AppData\Local\Temp\2BD4.tmp"114⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\2C70.tmp"C:\Users\Admin\AppData\Local\Temp\2C70.tmp"115⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\2D0C.tmp"C:\Users\Admin\AppData\Local\Temp\2D0C.tmp"116⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\2D89.tmp"C:\Users\Admin\AppData\Local\Temp\2D89.tmp"117⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\2E06.tmp"C:\Users\Admin\AppData\Local\Temp\2E06.tmp"118⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\2EA3.tmp"C:\Users\Admin\AppData\Local\Temp\2EA3.tmp"119⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\2F10.tmp"C:\Users\Admin\AppData\Local\Temp\2F10.tmp"120⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\2FBC.tmp"C:\Users\Admin\AppData\Local\Temp\2FBC.tmp"121⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\3049.tmp"C:\Users\Admin\AppData\Local\Temp\3049.tmp"122⤵PID:5084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-