Analysis
- max time kernel
131s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 02:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-30_f9fcdbe872313c4a1dedaa3d289e6795_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_f9fcdbe872313c4a1dedaa3d289e6795_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 2026-06-30_f9fcdbe872313c4a1dedaa3d289e6795_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260701-ce2lfact7m
- SHA256 ed7f646da80c5de9ff6d0e73a09df60ca602b296c5795ca486ee3a038dd99c61
- MD5 f9fcdbe872313c4a1dedaa3d289e6795
- SHA1 7ebea905476f67d8c726020c0f9abf99072d825e
- SHA512 352cbfa85d2d33ad37d66c699dbcd143bff8bf63676a0081f8efe6992424256d4e941813405b65e8aeb526c3bdd5777241c8dcf16746d2c3f50f33ff2b16e20a
- SSDEEP 12288:wU5rCOTeiD0L0as3Cjcvd/cT9NZ+3/v+I9hUG2VA:wUQOJD0Ps3gydQNGEA
- TLSH T1CEE4D02173D88531E9FB037859B5E6604EBDBD22A722D6CF6F9016BE0971BC08671723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2444 C85C.tmp 4700 C946.tmp 2544 CA6F.tmp 948 CBC7.tmp 960 CCE0.tmp 3240 CD7C.tmp 1056 CE86.tmp 3752 CFAF.tmp 5516 D06A.tmp 2312 D184.tmp 4276 D28D.tmp 1520 D358.tmp 3660 D433.tmp 2272 D52D.tmp 1060 D627.tmp 4660 D702.tmp 1872 D7DD.tmp 3740 D8E6.tmp 3748 D9C1.tmp 5784 DAFA.tmp 2744 DC22.tmp 2504 DD1C.tmp 356 DE45.tmp 4204 DF30.tmp 3180 E087.tmp 4748 E181.tmp 3648 E26C.tmp 4620 E366.tmp 4236 E47F.tmp 2360 E5A8.tmp 1628 E683.tmp 4364 E75D.tmp 932 E838.tmp 3924 E8D4.tmp 2796 E971.tmp 3884 E9FD.tmp 1732 EAF7.tmp 2660 EBB3.tmp 2452 EC3F.tmp 1616 ECEB.tmp 3500 EDB6.tmp 1344 EE53.tmp 760 EF0E.tmp 5736 EFD9.tmp 3124 F066.tmp 6080 F121.tmp 3084 F20C.tmp 2316 F2C7.tmp 1676 F335.tmp 632 F3B2.tmp 4308 F42F.tmp 1464 F49C.tmp 5892 F519.tmp 5932 F5A6.tmp 5420 F623.tmp 5828 F690.tmp 1768 F70D.tmp 1248 F78A.tmp 4500 F817.tmp 1320 F8C3.tmp 5064 F9BD.tmp 2792 FA59.tmp 5448 FAE5.tmp 1480 FB72.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F207.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 831C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 443E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3956.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7054.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F817.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7759.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 403B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A118.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4548.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9481.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D095.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F121.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E43C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 136A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 860A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 983A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 151F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 713E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84E6.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5664 wrote to memory of 2444 5664 2026-06-30_f9fcdbe872313c4a1dedaa3d289e6795_elex_mafia_stealc_tofsee.exe 88 PID 2444 wrote to memory of 4700 2444 C85C.tmp 89 PID 4700 wrote to memory of 2544 4700 C946.tmp 90 PID 2544 wrote to memory of 948 2544 CA6F.tmp 91 PID 948 wrote to memory of 960 948 CBC7.tmp 92 PID 960 wrote to memory of 3240 960 CCE0.tmp 93 PID 3240 wrote to memory of 1056 3240 CD7C.tmp 94 PID 1056 wrote to memory of 3752 1056 CE86.tmp 95 PID 3752 wrote to memory of 5516 3752 CFAF.tmp 96 PID 5516 wrote to memory of 2312 5516 D06A.tmp 97 PID 2312 wrote to memory of 4276 2312 D184.tmp 98 PID 4276 wrote to memory of 1520 4276 D28D.tmp 99 PID 1520 wrote to memory of 3660 1520 D358.tmp 100 PID 3660 wrote to memory of 2272 3660 D433.tmp 101 PID 2272 wrote to memory of 1060 2272 D52D.tmp 102 PID 1060 wrote to memory of 4660 1060 D627.tmp 103 PID 4660 wrote to memory of 1872 4660 D702.tmp 104 PID 1872 wrote to memory of 3740 1872 D7DD.tmp 105 PID 3740 wrote to memory of 3748 3740 D8E6.tmp 106 PID 3748 wrote to memory of 5784 3748 D9C1.tmp 107 PID 5784 wrote to memory of 2744 5784 DAFA.tmp 108 PID 2744 wrote to memory of 2504 2744 DC22.tmp 109 PID 2504 wrote to memory of 356 2504 DD1C.tmp 110 PID 356 wrote to memory of 4204 356 DE45.tmp 111 PID 4204 wrote to memory of 3180 4204 DF30.tmp 112 PID 3180 wrote to memory of 4748 3180 E087.tmp 113 PID 4748 wrote to memory of 3648 4748 E181.tmp 114 PID 3648 wrote to memory of 4620 3648 E26C.tmp 115 PID 4620 wrote to memory of 4236 4620 E366.tmp 116 PID 4236 wrote to memory of 2360 4236 E47F.tmp 117 PID 2360 wrote to memory of 1628 2360 E5A8.tmp 118 PID 1628 wrote to memory of 4364 1628 E683.tmp 119 PID 4364 wrote to memory of 932 4364 E75D.tmp 120 PID 932 wrote to memory of 3924 932 E838.tmp 121 PID 3924 wrote to memory of 2796 3924 E8D4.tmp 122 PID 2796 wrote to memory of 3884 2796 E971.tmp 123 PID 3884 wrote to memory of 1732 3884 E9FD.tmp 124 PID 1732 wrote to memory of 2660 1732 EAF7.tmp 125 PID 2660 wrote to memory of 2452 2660 EBB3.tmp 126 PID 2452 wrote to memory of 1616 2452 EC3F.tmp 127 PID 1616 wrote to memory of 3500 1616 ECEB.tmp 128 PID 3500 wrote to memory of 1344 3500 EDB6.tmp 129 PID 1344 wrote to memory of 760 1344 EE53.tmp 130 PID 760 wrote to memory of 5736 760 EF0E.tmp 131 PID 5736 wrote to memory of 3124 5736 EFD9.tmp 132 PID 3124 wrote to memory of 6080 3124 F066.tmp 133 PID 6080 wrote to memory of 3084 6080 F121.tmp 134 PID 3084 wrote to memory of 2316 3084 F20C.tmp 135 PID 2316 wrote to memory of 1676 2316 F2C7.tmp 136 PID 1676 wrote to memory of 632 1676 F335.tmp 137 PID 632 wrote to memory of 4308 632 F3B2.tmp 138 PID 4308 wrote to memory of 1464 4308 F42F.tmp 139 PID 1464 wrote to memory of 5892 1464 F49C.tmp 140 PID 5892 wrote to memory of 5932 5892 F519.tmp 141 PID 5932 wrote to memory of 5420 5932 F5A6.tmp 142 PID 5420 wrote to memory of 5828 5420 F623.tmp 143 PID 5828 wrote to memory of 1768 5828 F690.tmp 144 PID 1768 wrote to memory of 1248 1768 F70D.tmp 145 PID 1248 wrote to memory of 4500 1248 F78A.tmp 146 PID 4500 wrote to memory of 1320 4500 F817.tmp 147 PID 1484 wrote to memory of 5064 1484 F94F.tmp 149 PID 5064 wrote to memory of 2792 5064 F9BD.tmp 150 PID 2792 wrote to memory of 5448 2792 FA59.tmp 151 PID 5448 wrote to memory of 1480 5448 FAE5.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_f9fcdbe872313c4a1dedaa3d289e6795_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_f9fcdbe872313c4a1dedaa3d289e6795_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\C85C.tmp"C:\Users\Admin\AppData\Local\Temp\C85C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\C946.tmp"C:\Users\Admin\AppData\Local\Temp\C946.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\CA6F.tmp"C:\Users\Admin\AppData\Local\Temp\CA6F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\CE86.tmp"C:\Users\Admin\AppData\Local\Temp\CE86.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\CFAF.tmp"C:\Users\Admin\AppData\Local\Temp\CFAF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\D06A.tmp"C:\Users\Admin\AppData\Local\Temp\D06A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\D184.tmp"C:\Users\Admin\AppData\Local\Temp\D184.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\D28D.tmp"C:\Users\Admin\AppData\Local\Temp\D28D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\D358.tmp"C:\Users\Admin\AppData\Local\Temp\D358.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\D433.tmp"C:\Users\Admin\AppData\Local\Temp\D433.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\D52D.tmp"C:\Users\Admin\AppData\Local\Temp\D52D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\D627.tmp"C:\Users\Admin\AppData\Local\Temp\D627.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\D702.tmp"C:\Users\Admin\AppData\Local\Temp\D702.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\D8E6.tmp"C:\Users\Admin\AppData\Local\Temp\D8E6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\D9C1.tmp"C:\Users\Admin\AppData\Local\Temp\D9C1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\DAFA.tmp"C:\Users\Admin\AppData\Local\Temp\DAFA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\DC22.tmp"C:\Users\Admin\AppData\Local\Temp\DC22.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\DD1C.tmp"C:\Users\Admin\AppData\Local\Temp\DD1C.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\DE45.tmp"C:\Users\Admin\AppData\Local\Temp\DE45.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:356 -
C:\Users\Admin\AppData\Local\Temp\DF30.tmp"C:\Users\Admin\AppData\Local\Temp\DF30.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\E087.tmp"C:\Users\Admin\AppData\Local\Temp\E087.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\E181.tmp"C:\Users\Admin\AppData\Local\Temp\E181.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\E26C.tmp"C:\Users\Admin\AppData\Local\Temp\E26C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\E366.tmp"C:\Users\Admin\AppData\Local\Temp\E366.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\E47F.tmp"C:\Users\Admin\AppData\Local\Temp\E47F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\E5A8.tmp"C:\Users\Admin\AppData\Local\Temp\E5A8.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\E683.tmp"C:\Users\Admin\AppData\Local\Temp\E683.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\E75D.tmp"C:\Users\Admin\AppData\Local\Temp\E75D.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\E838.tmp"C:\Users\Admin\AppData\Local\Temp\E838.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\E8D4.tmp"C:\Users\Admin\AppData\Local\Temp\E8D4.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\E971.tmp"C:\Users\Admin\AppData\Local\Temp\E971.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\E9FD.tmp"C:\Users\Admin\AppData\Local\Temp\E9FD.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\EAF7.tmp"C:\Users\Admin\AppData\Local\Temp\EAF7.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\EC3F.tmp"C:\Users\Admin\AppData\Local\Temp\EC3F.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\ECEB.tmp"C:\Users\Admin\AppData\Local\Temp\ECEB.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\EDB6.tmp"C:\Users\Admin\AppData\Local\Temp\EDB6.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\EE53.tmp"C:\Users\Admin\AppData\Local\Temp\EE53.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\EF0E.tmp"C:\Users\Admin\AppData\Local\Temp\EF0E.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\EFD9.tmp"C:\Users\Admin\AppData\Local\Temp\EFD9.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\F066.tmp"C:\Users\Admin\AppData\Local\Temp\F066.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\F121.tmp"C:\Users\Admin\AppData\Local\Temp\F121.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\F20C.tmp"C:\Users\Admin\AppData\Local\Temp\F20C.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\F2C7.tmp"C:\Users\Admin\AppData\Local\Temp\F2C7.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\F42F.tmp"C:\Users\Admin\AppData\Local\Temp\F42F.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\F49C.tmp"C:\Users\Admin\AppData\Local\Temp\F49C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\F519.tmp"C:\Users\Admin\AppData\Local\Temp\F519.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5892 -
C:\Users\Admin\AppData\Local\Temp\F5A6.tmp"C:\Users\Admin\AppData\Local\Temp\F5A6.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\F623.tmp"C:\Users\Admin\AppData\Local\Temp\F623.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\F690.tmp"C:\Users\Admin\AppData\Local\Temp\F690.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Users\Admin\AppData\Local\Temp\F70D.tmp"C:\Users\Admin\AppData\Local\Temp\F70D.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\F78A.tmp"C:\Users\Admin\AppData\Local\Temp\F78A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\F817.tmp"C:\Users\Admin\AppData\Local\Temp\F817.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\F8C3.tmp"C:\Users\Admin\AppData\Local\Temp\F8C3.tmp"61⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\F94F.tmp"C:\Users\Admin\AppData\Local\Temp\F94F.tmp"62⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\F9BD.tmp"C:\Users\Admin\AppData\Local\Temp\F9BD.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\FA59.tmp"C:\Users\Admin\AppData\Local\Temp\FA59.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\FAE5.tmp"C:\Users\Admin\AppData\Local\Temp\FAE5.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\FB72.tmp"C:\Users\Admin\AppData\Local\Temp\FB72.tmp"66⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"C:\Users\Admin\AppData\Local\Temp\FBFF.tmp"67⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\FC9B.tmp"C:\Users\Admin\AppData\Local\Temp\FC9B.tmp"68⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\FD18.tmp"C:\Users\Admin\AppData\Local\Temp\FD18.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\FDA5.tmp"C:\Users\Admin\AppData\Local\Temp\FDA5.tmp"70⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\FE31.tmp"C:\Users\Admin\AppData\Local\Temp\FE31.tmp"71⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\FEBE.tmp"C:\Users\Admin\AppData\Local\Temp\FEBE.tmp"72⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"C:\Users\Admin\AppData\Local\Temp\FF3B.tmp"73⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\FFE7.tmp"C:\Users\Admin\AppData\Local\Temp\FFE7.tmp"74⤵PID:5124
-
C:\Users\Admin\AppData\Local\Temp\73.tmp"C:\Users\Admin\AppData\Local\Temp\73.tmp"75⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\F0.tmp"C:\Users\Admin\AppData\Local\Temp\F0.tmp"76⤵PID:5720
-
C:\Users\Admin\AppData\Local\Temp\17D.tmp"C:\Users\Admin\AppData\Local\Temp\17D.tmp"77⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\219.tmp"C:\Users\Admin\AppData\Local\Temp\219.tmp"78⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\287.tmp"C:\Users\Admin\AppData\Local\Temp\287.tmp"79⤵PID:5332
-
C:\Users\Admin\AppData\Local\Temp\332.tmp"C:\Users\Admin\AppData\Local\Temp\332.tmp"80⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\3CF.tmp"C:\Users\Admin\AppData\Local\Temp\3CF.tmp"81⤵PID:6020
-
C:\Users\Admin\AppData\Local\Temp\44C.tmp"C:\Users\Admin\AppData\Local\Temp\44C.tmp"82⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\4C9.tmp"C:\Users\Admin\AppData\Local\Temp\4C9.tmp"83⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\546.tmp"C:\Users\Admin\AppData\Local\Temp\546.tmp"84⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\5E2.tmp"C:\Users\Admin\AppData\Local\Temp\5E2.tmp"85⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\65F.tmp"C:\Users\Admin\AppData\Local\Temp\65F.tmp"86⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\6DC.tmp"C:\Users\Admin\AppData\Local\Temp\6DC.tmp"87⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\759.tmp"C:\Users\Admin\AppData\Local\Temp\759.tmp"88⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\7F5.tmp"C:\Users\Admin\AppData\Local\Temp\7F5.tmp"89⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\872.tmp"C:\Users\Admin\AppData\Local\Temp\872.tmp"90⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\8EF.tmp"C:\Users\Admin\AppData\Local\Temp\8EF.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\95D.tmp"C:\Users\Admin\AppData\Local\Temp\95D.tmp"92⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\9F9.tmp"C:\Users\Admin\AppData\Local\Temp\9F9.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\A76.tmp"C:\Users\Admin\AppData\Local\Temp\A76.tmp"94⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\B12.tmp"C:\Users\Admin\AppData\Local\Temp\B12.tmp"95⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\BAE.tmp"C:\Users\Admin\AppData\Local\Temp\BAE.tmp"96⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\C4B.tmp"C:\Users\Admin\AppData\Local\Temp\C4B.tmp"97⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\CD7.tmp"C:\Users\Admin\AppData\Local\Temp\CD7.tmp"98⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\D64.tmp"C:\Users\Admin\AppData\Local\Temp\D64.tmp"99⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\DE1.tmp"C:\Users\Admin\AppData\Local\Temp\DE1.tmp"100⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\E6D.tmp"C:\Users\Admin\AppData\Local\Temp\E6D.tmp"101⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\EFA.tmp"C:\Users\Admin\AppData\Local\Temp\EFA.tmp"102⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\F87.tmp"C:\Users\Admin\AppData\Local\Temp\F87.tmp"103⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\1004.tmp"C:\Users\Admin\AppData\Local\Temp\1004.tmp"104⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\1090.tmp"C:\Users\Admin\AppData\Local\Temp\1090.tmp"105⤵PID:5576
-
C:\Users\Admin\AppData\Local\Temp\111D.tmp"C:\Users\Admin\AppData\Local\Temp\111D.tmp"106⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\11AA.tmp"C:\Users\Admin\AppData\Local\Temp\11AA.tmp"107⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\1227.tmp"C:\Users\Admin\AppData\Local\Temp\1227.tmp"108⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\12B3.tmp"C:\Users\Admin\AppData\Local\Temp\12B3.tmp"109⤵PID:5944
-
C:\Users\Admin\AppData\Local\Temp\1330.tmp"C:\Users\Admin\AppData\Local\Temp\1330.tmp"110⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\13CC.tmp"C:\Users\Admin\AppData\Local\Temp\13CC.tmp"111⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\1449.tmp"C:\Users\Admin\AppData\Local\Temp\1449.tmp"112⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\14D6.tmp"C:\Users\Admin\AppData\Local\Temp\14D6.tmp"113⤵PID:5564
-
C:\Users\Admin\AppData\Local\Temp\1563.tmp"C:\Users\Admin\AppData\Local\Temp\1563.tmp"114⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\15EF.tmp"C:\Users\Admin\AppData\Local\Temp\15EF.tmp"115⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\166C.tmp"C:\Users\Admin\AppData\Local\Temp\166C.tmp"116⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\16E9.tmp"C:\Users\Admin\AppData\Local\Temp\16E9.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\1776.tmp"C:\Users\Admin\AppData\Local\Temp\1776.tmp"118⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\1803.tmp"C:\Users\Admin\AppData\Local\Temp\1803.tmp"119⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\1880.tmp"C:\Users\Admin\AppData\Local\Temp\1880.tmp"120⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"122⤵PID:1864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-