Analysis
- max time kernel
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 16:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_e52af973ce13e76cdbcdca67f742b2db_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_e52af973ce13e76cdbcdca67f742b2db_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-30_e52af973ce13e76cdbcdca67f742b2db_elex_mafia_stealc_tofsee.exe
- Size 541KB
- Sample260730-vcd2gace39
- SHA256 d76c8c21fe18151e9996d88f60e7e4389307fb736d99a4d53ef35538102ed0af
- MD5 e52af973ce13e76cdbcdca67f742b2db
- SHA1 ea69f69aa679b4fa3906b44368acb50a0eaa11e4
- SHA512 c12c2bd1d808a67b3a44d83c582b7cb6439afaab1ea4832d6c8066a0425d0ad75947fcb52a7b62b10ce193cc99c3920779428777f4c99e74e028ed2c3caeecab
- SSDEEP 12288:HU5rCOTeiJ0ggJs53Zsv2jp/9fc+mntNZb73ctO:HUQOJJ0VJe3ZXjMLtNV73ctO
- TLSH T171C4E025B644C232E6C202711BDAEBE26A3E7C71572658C37B84627E2BB17D0D37534B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 940 A791.tmp 5784 A9B3.tmp 2056 AABD.tmp 3040 AB3A.tmp 5360 ABC7.tmp 4396 AC53.tmp 4256 AD0F.tmp 3824 ADAB.tmp 3568 AE47.tmp 1148 AEE4.tmp 2740 AF8F.tmp 1360 B07A.tmp 1284 B135.tmp 4152 B1D2.tmp 3364 B28D.tmp 3408 B339.tmp 2996 B3E5.tmp 4608 B471.tmp 5264 B4FE.tmp 5692 B5D9.tmp 4120 B685.tmp 2952 B702.tmp 5144 B78E.tmp 2620 B81B.tmp 5280 B898.tmp 5256 B963.tmp 1384 BA4D.tmp 1960 BB19.tmp 5780 BBB5.tmp 784 BC51.tmp 3768 BCDE.tmp 1084 BD8A.tmp 1552 BE35.tmp 3420 BEC2.tmp 5040 BF4F.tmp 2040 BFCC.tmp 3144 C049.tmp 5448 C0C6.tmp 2416 C143.tmp 2324 C1C0.tmp 2948 C23D.tmp 3448 C2BA.tmp 6116 C356.tmp 3472 C3E3.tmp 4044 C460.tmp 1212 C4EC.tmp 5320 C569.tmp 4716 C5D7.tmp 4664 C682.tmp 200 C6FF.tmp 2800 C77C.tmp 1368 C7F9.tmp 2784 C876.tmp 3424 C903.tmp 4048 C99F.tmp 5308 CA3C.tmp 5084 CAB9.tmp 5724 CB45.tmp 5700 CBC2.tmp 2708 CC4F.tmp 2356 CCBC.tmp 4260 CD68.tmp 464 CDE5.tmp 1232 CE62.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4845.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A152.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E706.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 539F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 869.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3361.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2721.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2806.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 411C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E96C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 227D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2481.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 281B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3673.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1401.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 147E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 181D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2982.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E570.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6732.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1790.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 423A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49FB.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3452 wrote to memory of 940 3452 2026-07-30_e52af973ce13e76cdbcdca67f742b2db_elex_mafia_stealc_tofsee.exe 88 PID 940 wrote to memory of 5784 940 A791.tmp 89 PID 5784 wrote to memory of 2056 5784 A9B3.tmp 90 PID 2056 wrote to memory of 3040 2056 AABD.tmp 91 PID 3040 wrote to memory of 5360 3040 AB3A.tmp 92 PID 5360 wrote to memory of 4396 5360 ABC7.tmp 93 PID 4396 wrote to memory of 4256 4396 AC53.tmp 94 PID 4256 wrote to memory of 3824 4256 AD0F.tmp 95 PID 3824 wrote to memory of 3568 3824 ADAB.tmp 96 PID 3568 wrote to memory of 1148 3568 AE47.tmp 97 PID 1148 wrote to memory of 2740 1148 AEE4.tmp 98 PID 2740 wrote to memory of 1360 2740 AF8F.tmp 99 PID 1360 wrote to memory of 1284 1360 B07A.tmp 100 PID 1284 wrote to memory of 4152 1284 B135.tmp 101 PID 4152 wrote to memory of 3364 4152 B1D2.tmp 102 PID 3364 wrote to memory of 3408 3364 B28D.tmp 103 PID 3408 wrote to memory of 2996 3408 B339.tmp 104 PID 2996 wrote to memory of 4608 2996 B3E5.tmp 105 PID 4608 wrote to memory of 5264 4608 B471.tmp 106 PID 5264 wrote to memory of 5692 5264 B4FE.tmp 107 PID 5692 wrote to memory of 4120 5692 B5D9.tmp 108 PID 4120 wrote to memory of 2952 4120 B685.tmp 109 PID 2952 wrote to memory of 5144 2952 B702.tmp 110 PID 5144 wrote to memory of 2620 5144 B78E.tmp 111 PID 2620 wrote to memory of 5280 2620 B81B.tmp 112 PID 5280 wrote to memory of 5256 5280 B898.tmp 113 PID 5256 wrote to memory of 1384 5256 B963.tmp 114 PID 1384 wrote to memory of 1960 1384 BA4D.tmp 115 PID 1960 wrote to memory of 5780 1960 BB19.tmp 116 PID 5780 wrote to memory of 784 5780 BBB5.tmp 117 PID 784 wrote to memory of 3768 784 BC51.tmp 118 PID 3768 wrote to memory of 1084 3768 BCDE.tmp 119 PID 1084 wrote to memory of 1552 1084 BD8A.tmp 120 PID 1552 wrote to memory of 3420 1552 BE35.tmp 121 PID 3420 wrote to memory of 5040 3420 BEC2.tmp 122 PID 5040 wrote to memory of 2040 5040 BF4F.tmp 123 PID 2040 wrote to memory of 3144 2040 BFCC.tmp 124 PID 3144 wrote to memory of 5448 3144 C049.tmp 125 PID 5448 wrote to memory of 2416 5448 C0C6.tmp 126 PID 2416 wrote to memory of 2324 2416 C143.tmp 127 PID 2324 wrote to memory of 2948 2324 C1C0.tmp 128 PID 2948 wrote to memory of 3448 2948 C23D.tmp 129 PID 3448 wrote to memory of 6116 3448 C2BA.tmp 130 PID 6116 wrote to memory of 3472 6116 C356.tmp 131 PID 3472 wrote to memory of 4044 3472 C3E3.tmp 132 PID 4044 wrote to memory of 1212 4044 C460.tmp 133 PID 1212 wrote to memory of 5320 1212 C4EC.tmp 134 PID 5320 wrote to memory of 4716 5320 C569.tmp 135 PID 4716 wrote to memory of 4664 4716 C5D7.tmp 136 PID 4664 wrote to memory of 200 4664 C682.tmp 137 PID 200 wrote to memory of 2800 200 C6FF.tmp 138 PID 2800 wrote to memory of 1368 2800 C77C.tmp 139 PID 1368 wrote to memory of 2784 1368 C7F9.tmp 140 PID 2784 wrote to memory of 3424 2784 C876.tmp 141 PID 3424 wrote to memory of 4048 3424 C903.tmp 142 PID 4048 wrote to memory of 5308 4048 C99F.tmp 143 PID 5308 wrote to memory of 5084 5308 CA3C.tmp 144 PID 5084 wrote to memory of 5724 5084 CAB9.tmp 145 PID 5724 wrote to memory of 5700 5724 CB45.tmp 146 PID 5700 wrote to memory of 2708 5700 CBC2.tmp 147 PID 2708 wrote to memory of 2356 2708 CC4F.tmp 148 PID 2356 wrote to memory of 4260 2356 CCBC.tmp 149 PID 4260 wrote to memory of 464 4260 CD68.tmp 150 PID 464 wrote to memory of 1232 464 CDE5.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_e52af973ce13e76cdbcdca67f742b2db_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_e52af973ce13e76cdbcdca67f742b2db_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\A791.tmp"C:\Users\Admin\AppData\Local\Temp\A791.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\A9B3.tmp"C:\Users\Admin\AppData\Local\Temp\A9B3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\AABD.tmp"C:\Users\Admin\AppData\Local\Temp\AABD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\AB3A.tmp"C:\Users\Admin\AppData\Local\Temp\AB3A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\ABC7.tmp"C:\Users\Admin\AppData\Local\Temp\ABC7.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\AC53.tmp"C:\Users\Admin\AppData\Local\Temp\AC53.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\AD0F.tmp"C:\Users\Admin\AppData\Local\Temp\AD0F.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"C:\Users\Admin\AppData\Local\Temp\ADAB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\AE47.tmp"C:\Users\Admin\AppData\Local\Temp\AE47.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\AEE4.tmp"C:\Users\Admin\AppData\Local\Temp\AEE4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"C:\Users\Admin\AppData\Local\Temp\AF8F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\B07A.tmp"C:\Users\Admin\AppData\Local\Temp\B07A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\B135.tmp"C:\Users\Admin\AppData\Local\Temp\B135.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\B28D.tmp"C:\Users\Admin\AppData\Local\Temp\B28D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"C:\Users\Admin\AppData\Local\Temp\B3E5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\B4FE.tmp"C:\Users\Admin\AppData\Local\Temp\B4FE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Users\Admin\AppData\Local\Temp\B5D9.tmp"C:\Users\Admin\AppData\Local\Temp\B5D9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Users\Admin\AppData\Local\Temp\B685.tmp"C:\Users\Admin\AppData\Local\Temp\B685.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\B702.tmp"C:\Users\Admin\AppData\Local\Temp\B702.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\B78E.tmp"C:\Users\Admin\AppData\Local\Temp\B78E.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\B81B.tmp"C:\Users\Admin\AppData\Local\Temp\B81B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\B898.tmp"C:\Users\Admin\AppData\Local\Temp\B898.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\B963.tmp"C:\Users\Admin\AppData\Local\Temp\B963.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5256 -
C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"C:\Users\Admin\AppData\Local\Temp\BA4D.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\BB19.tmp"C:\Users\Admin\AppData\Local\Temp\BB19.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\BBB5.tmp"C:\Users\Admin\AppData\Local\Temp\BBB5.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\BC51.tmp"C:\Users\Admin\AppData\Local\Temp\BC51.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\BCDE.tmp"C:\Users\Admin\AppData\Local\Temp\BCDE.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\BD8A.tmp"C:\Users\Admin\AppData\Local\Temp\BD8A.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\BE35.tmp"C:\Users\Admin\AppData\Local\Temp\BE35.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\BEC2.tmp"C:\Users\Admin\AppData\Local\Temp\BEC2.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"C:\Users\Admin\AppData\Local\Temp\BF4F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\BFCC.tmp"C:\Users\Admin\AppData\Local\Temp\BFCC.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\C049.tmp"C:\Users\Admin\AppData\Local\Temp\C049.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\C0C6.tmp"C:\Users\Admin\AppData\Local\Temp\C0C6.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\C143.tmp"C:\Users\Admin\AppData\Local\Temp\C143.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\C1C0.tmp"C:\Users\Admin\AppData\Local\Temp\C1C0.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\C23D.tmp"C:\Users\Admin\AppData\Local\Temp\C23D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\C2BA.tmp"C:\Users\Admin\AppData\Local\Temp\C2BA.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\C356.tmp"C:\Users\Admin\AppData\Local\Temp\C356.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\C3E3.tmp"C:\Users\Admin\AppData\Local\Temp\C3E3.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\C460.tmp"C:\Users\Admin\AppData\Local\Temp\C460.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\C4EC.tmp"C:\Users\Admin\AppData\Local\Temp\C4EC.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\C569.tmp"C:\Users\Admin\AppData\Local\Temp\C569.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\C5D7.tmp"C:\Users\Admin\AppData\Local\Temp\C5D7.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\C682.tmp"C:\Users\Admin\AppData\Local\Temp\C682.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"C:\Users\Admin\AppData\Local\Temp\C6FF.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\C77C.tmp"C:\Users\Admin\AppData\Local\Temp\C77C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\C7F9.tmp"C:\Users\Admin\AppData\Local\Temp\C7F9.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\C876.tmp"C:\Users\Admin\AppData\Local\Temp\C876.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\C903.tmp"C:\Users\Admin\AppData\Local\Temp\C903.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\C99F.tmp"C:\Users\Admin\AppData\Local\Temp\C99F.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\CA3C.tmp"C:\Users\Admin\AppData\Local\Temp\CA3C.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\CAB9.tmp"C:\Users\Admin\AppData\Local\Temp\CAB9.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\CB45.tmp"C:\Users\Admin\AppData\Local\Temp\CB45.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\CBC2.tmp"C:\Users\Admin\AppData\Local\Temp\CBC2.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\CC4F.tmp"C:\Users\Admin\AppData\Local\Temp\CC4F.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\CCBC.tmp"C:\Users\Admin\AppData\Local\Temp\CCBC.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\CD68.tmp"C:\Users\Admin\AppData\Local\Temp\CD68.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\CDE5.tmp"C:\Users\Admin\AppData\Local\Temp\CDE5.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\CE62.tmp"C:\Users\Admin\AppData\Local\Temp\CE62.tmp"65⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\CF0E.tmp"C:\Users\Admin\AppData\Local\Temp\CF0E.tmp"66⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"C:\Users\Admin\AppData\Local\Temp\CF8B.tmp"67⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"C:\Users\Admin\AppData\Local\Temp\CFF8.tmp"68⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\D075.tmp"C:\Users\Admin\AppData\Local\Temp\D075.tmp"69⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\D0F2.tmp"C:\Users\Admin\AppData\Local\Temp\D0F2.tmp"70⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\D160.tmp"C:\Users\Admin\AppData\Local\Temp\D160.tmp"71⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\D1DD.tmp"C:\Users\Admin\AppData\Local\Temp\D1DD.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\D24A.tmp"C:\Users\Admin\AppData\Local\Temp\D24A.tmp"73⤵PID:5980
-
C:\Users\Admin\AppData\Local\Temp\D2B7.tmp"C:\Users\Admin\AppData\Local\Temp\D2B7.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\D334.tmp"C:\Users\Admin\AppData\Local\Temp\D334.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\D3C1.tmp"C:\Users\Admin\AppData\Local\Temp\D3C1.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\D47D.tmp"C:\Users\Admin\AppData\Local\Temp\D47D.tmp"77⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\D4EA.tmp"C:\Users\Admin\AppData\Local\Temp\D4EA.tmp"78⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\D586.tmp"C:\Users\Admin\AppData\Local\Temp\D586.tmp"79⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"C:\Users\Admin\AppData\Local\Temp\D5E4.tmp"80⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\D671.tmp"C:\Users\Admin\AppData\Local\Temp\D671.tmp"81⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\D6FD.tmp"C:\Users\Admin\AppData\Local\Temp\D6FD.tmp"82⤵PID:5744
-
C:\Users\Admin\AppData\Local\Temp\D799.tmp"C:\Users\Admin\AppData\Local\Temp\D799.tmp"83⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\D855.tmp"C:\Users\Admin\AppData\Local\Temp\D855.tmp"84⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"85⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\D94F.tmp"C:\Users\Admin\AppData\Local\Temp\D94F.tmp"86⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\D9DC.tmp"C:\Users\Admin\AppData\Local\Temp\D9DC.tmp"87⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\DA68.tmp"C:\Users\Admin\AppData\Local\Temp\DA68.tmp"88⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\DB14.tmp"C:\Users\Admin\AppData\Local\Temp\DB14.tmp"89⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\DB91.tmp"C:\Users\Admin\AppData\Local\Temp\DB91.tmp"90⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\DBFE.tmp"C:\Users\Admin\AppData\Local\Temp\DBFE.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\DC9B.tmp"C:\Users\Admin\AppData\Local\Temp\DC9B.tmp"92⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\DD18.tmp"C:\Users\Admin\AppData\Local\Temp\DD18.tmp"93⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"C:\Users\Admin\AppData\Local\Temp\DDB4.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\DE12.tmp"C:\Users\Admin\AppData\Local\Temp\DE12.tmp"95⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\DE8F.tmp"C:\Users\Admin\AppData\Local\Temp\DE8F.tmp"96⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\DF2B.tmp"C:\Users\Admin\AppData\Local\Temp\DF2B.tmp"97⤵PID:5920
-
C:\Users\Admin\AppData\Local\Temp\DFB8.tmp"C:\Users\Admin\AppData\Local\Temp\DFB8.tmp"98⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\E035.tmp"C:\Users\Admin\AppData\Local\Temp\E035.tmp"99⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\E0B2.tmp"C:\Users\Admin\AppData\Local\Temp\E0B2.tmp"100⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\E12F.tmp"C:\Users\Admin\AppData\Local\Temp\E12F.tmp"101⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\E19C.tmp"C:\Users\Admin\AppData\Local\Temp\E19C.tmp"102⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\E238.tmp"C:\Users\Admin\AppData\Local\Temp\E238.tmp"103⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"C:\Users\Admin\AppData\Local\Temp\E2B5.tmp"104⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\E342.tmp"C:\Users\Admin\AppData\Local\Temp\E342.tmp"105⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\E3CE.tmp"C:\Users\Admin\AppData\Local\Temp\E3CE.tmp"106⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\E44B.tmp"C:\Users\Admin\AppData\Local\Temp\E44B.tmp"107⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\E4F7.tmp"C:\Users\Admin\AppData\Local\Temp\E4F7.tmp"108⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\E5A3.tmp"C:\Users\Admin\AppData\Local\Temp\E5A3.tmp"109⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\E66E.tmp"C:\Users\Admin\AppData\Local\Temp\E66E.tmp"110⤵PID:5848
-
C:\Users\Admin\AppData\Local\Temp\E71A.tmp"C:\Users\Admin\AppData\Local\Temp\E71A.tmp"111⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\E7C6.tmp"C:\Users\Admin\AppData\Local\Temp\E7C6.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\E872.tmp"C:\Users\Admin\AppData\Local\Temp\E872.tmp"113⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\E8EF.tmp"C:\Users\Admin\AppData\Local\Temp\E8EF.tmp"114⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\E96C.tmp"C:\Users\Admin\AppData\Local\Temp\E96C.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"C:\Users\Admin\AppData\Local\Temp\E9D9.tmp"116⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\EA66.tmp"C:\Users\Admin\AppData\Local\Temp\EA66.tmp"117⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\EAD3.tmp"C:\Users\Admin\AppData\Local\Temp\EAD3.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\EB50.tmp"C:\Users\Admin\AppData\Local\Temp\EB50.tmp"119⤵PID:5844
-
C:\Users\Admin\AppData\Local\Temp\EBBE.tmp"C:\Users\Admin\AppData\Local\Temp\EBBE.tmp"120⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"C:\Users\Admin\AppData\Local\Temp\EC4A.tmp"121⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\ECC7.tmp"C:\Users\Admin\AppData\Local\Temp\ECC7.tmp"122⤵PID:1828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-