Analysis
- max time kernel
107s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 16:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_89ade84bfeacf08f036cb02f8d5d9760_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_89ade84bfeacf08f036cb02f8d5d9760_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-01_89ade84bfeacf08f036cb02f8d5d9760_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260801-txf6wsde36
- SHA256 c7fed8efbc423eb00d6d67fec8aa2b66efed724b916dd9cd47a3d43161ff48bd
- MD5 89ade84bfeacf08f036cb02f8d5d9760
- SHA1 4445dd7899f05a35002a5175ea5e7b2fd25ab992
- SHA512 78347090544e76b1ee0d781ffee037c46c2ff6a41ce1c1e2e251f76f465a78302da917f66862398292c36569fa7d29bb61e7a6f7dae1c14ed8d32291e20dcdeb
- SSDEEP 6144:qorf3lPvovsgZnqG2C7mOTeiL9DU6LxzN3aE/OJwZMTodhJjY1TFK6rJ4xIKM/HB:HU5rCOTeiJL3aQwIMx1ISDdwSnNLNNZ
- TLSH T13BB4F0217585C032E69202314AE6EBB22D7A7D719B26A4C77BD4673D2FB02E1E774343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2572 F5F4.tmp 4860 F6CF.tmp 2112 F7A9.tmp 4536 F846.tmp 3196 F8F1.tmp 1472 F98E.tmp 4744 FA49.tmp 1096 FB53.tmp 5628 FBEF.tmp 1384 FC6C.tmp 1048 FD28.tmp 2872 FDC4.tmp 5196 FEAE.tmp 4052 FF5A.tmp 4876 25.tmp 5816 D1.tmp 3060 16D.tmp 4228 1DB.tmp 244 238.tmp 4856 2E4.tmp 2248 371.tmp 5204 42C.tmp 2816 507.tmp 4364 5D2.tmp 3508 65F.tmp 5936 71A.tmp 5712 797.tmp 472 863.tmp 944 95D.tmp 4104 A28.tmp 5212 AF3.tmp 1432 B7F.tmp 4212 BFC.tmp 1200 C6A.tmp 3264 CE7.tmp 3704 D73.tmp 5636 E3F.tmp 1428 EBC.tmp 4368 F39.tmp 4864 FB6.tmp 1916 1042.tmp 4192 10B0.tmp 3592 116B.tmp 2148 11D8.tmp 3888 1255.tmp 5852 12F2.tmp 2536 136F.tmp 2204 13EC.tmp 5904 1469.tmp 2108 1515.tmp 3444 15B1.tmp 3600 163D.tmp 4560 16DA.tmp 1180 1757.tmp 3472 17E3.tmp 4684 1870.tmp 4456 18ED.tmp 1300 196A.tmp 972 19D7.tmp 5076 1A54.tmp 1280 1AF1.tmp 3764 1B7D.tmp 4288 1C19.tmp 4072 1C96.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 797.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5625.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E565.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6284.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E90E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2377.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_89ade84bfeacf08f036cb02f8d5d9760_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9699.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F17A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 507.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 985E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A82D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A994.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E99B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D874.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9319.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 863.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5431.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 674B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8870.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5083.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9442.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D160.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 348E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B3C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4324 wrote to memory of 2572 4324 2026-08-01_89ade84bfeacf08f036cb02f8d5d9760_elex_mafia_stealc_tofsee.exe 88 PID 2572 wrote to memory of 4860 2572 F5F4.tmp 90 PID 4860 wrote to memory of 2112 4860 F6CF.tmp 91 PID 2112 wrote to memory of 4536 2112 F7A9.tmp 92 PID 4536 wrote to memory of 3196 4536 F846.tmp 93 PID 3196 wrote to memory of 1472 3196 F8F1.tmp 94 PID 1472 wrote to memory of 4744 1472 F98E.tmp 95 PID 4744 wrote to memory of 1096 4744 FA49.tmp 96 PID 1096 wrote to memory of 5628 1096 FB53.tmp 97 PID 5628 wrote to memory of 1384 5628 FBEF.tmp 98 PID 1384 wrote to memory of 1048 1384 FC6C.tmp 99 PID 1048 wrote to memory of 2872 1048 FD28.tmp 100 PID 2872 wrote to memory of 5196 2872 FDC4.tmp 101 PID 5196 wrote to memory of 4052 5196 FEAE.tmp 102 PID 4052 wrote to memory of 4876 4052 FF5A.tmp 103 PID 4876 wrote to memory of 5816 4876 25.tmp 104 PID 5816 wrote to memory of 3060 5816 D1.tmp 105 PID 3060 wrote to memory of 4228 3060 16D.tmp 106 PID 4228 wrote to memory of 244 4228 1DB.tmp 107 PID 244 wrote to memory of 4856 244 238.tmp 108 PID 4856 wrote to memory of 2248 4856 2E4.tmp 109 PID 2248 wrote to memory of 5204 2248 371.tmp 110 PID 5204 wrote to memory of 2816 5204 42C.tmp 111 PID 2816 wrote to memory of 4364 2816 507.tmp 112 PID 4364 wrote to memory of 3508 4364 5D2.tmp 113 PID 3508 wrote to memory of 5936 3508 65F.tmp 114 PID 5936 wrote to memory of 5712 5936 71A.tmp 115 PID 5712 wrote to memory of 472 5712 797.tmp 116 PID 472 wrote to memory of 944 472 863.tmp 117 PID 944 wrote to memory of 4104 944 95D.tmp 118 PID 4104 wrote to memory of 5212 4104 A28.tmp 119 PID 5212 wrote to memory of 1432 5212 AF3.tmp 120 PID 1432 wrote to memory of 4212 1432 B7F.tmp 121 PID 4212 wrote to memory of 1200 4212 BFC.tmp 122 PID 1200 wrote to memory of 3264 1200 C6A.tmp 123 PID 3264 wrote to memory of 3704 3264 CE7.tmp 124 PID 3704 wrote to memory of 5636 3704 D73.tmp 125 PID 5636 wrote to memory of 1428 5636 E3F.tmp 126 PID 1428 wrote to memory of 4368 1428 EBC.tmp 127 PID 4368 wrote to memory of 4864 4368 F39.tmp 128 PID 4864 wrote to memory of 1916 4864 FB6.tmp 129 PID 1916 wrote to memory of 4192 1916 1042.tmp 130 PID 4192 wrote to memory of 3592 4192 10B0.tmp 131 PID 3592 wrote to memory of 2148 3592 116B.tmp 132 PID 2148 wrote to memory of 3888 2148 11D8.tmp 133 PID 3888 wrote to memory of 5852 3888 1255.tmp 134 PID 5852 wrote to memory of 2536 5852 12F2.tmp 135 PID 2536 wrote to memory of 2204 2536 136F.tmp 136 PID 2204 wrote to memory of 5904 2204 13EC.tmp 137 PID 5904 wrote to memory of 2108 5904 1469.tmp 138 PID 2108 wrote to memory of 3444 2108 1515.tmp 139 PID 3444 wrote to memory of 3600 3444 15B1.tmp 140 PID 3600 wrote to memory of 4560 3600 163D.tmp 141 PID 4560 wrote to memory of 1180 4560 16DA.tmp 142 PID 1180 wrote to memory of 3472 1180 1757.tmp 143 PID 3472 wrote to memory of 4684 3472 17E3.tmp 144 PID 4684 wrote to memory of 4456 4684 1870.tmp 145 PID 4456 wrote to memory of 1300 4456 18ED.tmp 146 PID 1300 wrote to memory of 972 1300 196A.tmp 147 PID 972 wrote to memory of 5076 972 19D7.tmp 148 PID 5076 wrote to memory of 1280 5076 1A54.tmp 149 PID 1280 wrote to memory of 3764 1280 1AF1.tmp 150 PID 3764 wrote to memory of 4288 3764 1B7D.tmp 151 PID 4288 wrote to memory of 4072 4288 1C19.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_89ade84bfeacf08f036cb02f8d5d9760_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_89ade84bfeacf08f036cb02f8d5d9760_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\F5F4.tmp"C:\Users\Admin\AppData\Local\Temp\F5F4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\F6CF.tmp"C:\Users\Admin\AppData\Local\Temp\F6CF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\F7A9.tmp"C:\Users\Admin\AppData\Local\Temp\F7A9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\F846.tmp"C:\Users\Admin\AppData\Local\Temp\F846.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\F8F1.tmp"C:\Users\Admin\AppData\Local\Temp\F8F1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\F98E.tmp"C:\Users\Admin\AppData\Local\Temp\F98E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\FA49.tmp"C:\Users\Admin\AppData\Local\Temp\FA49.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\FB53.tmp"C:\Users\Admin\AppData\Local\Temp\FB53.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\FBEF.tmp"C:\Users\Admin\AppData\Local\Temp\FBEF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\FC6C.tmp"C:\Users\Admin\AppData\Local\Temp\FC6C.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\FD28.tmp"C:\Users\Admin\AppData\Local\Temp\FD28.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\FDC4.tmp"C:\Users\Admin\AppData\Local\Temp\FDC4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\FEAE.tmp"C:\Users\Admin\AppData\Local\Temp\FEAE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\FF5A.tmp"C:\Users\Admin\AppData\Local\Temp\FF5A.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\25.tmp"C:\Users\Admin\AppData\Local\Temp\25.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\D1.tmp"C:\Users\Admin\AppData\Local\Temp\D1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\16D.tmp"C:\Users\Admin\AppData\Local\Temp\16D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\1DB.tmp"C:\Users\Admin\AppData\Local\Temp\1DB.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\238.tmp"C:\Users\Admin\AppData\Local\Temp\238.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Users\Admin\AppData\Local\Temp\2E4.tmp"C:\Users\Admin\AppData\Local\Temp\2E4.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\371.tmp"C:\Users\Admin\AppData\Local\Temp\371.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\42C.tmp"C:\Users\Admin\AppData\Local\Temp\42C.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Users\Admin\AppData\Local\Temp\507.tmp"C:\Users\Admin\AppData\Local\Temp\507.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\5D2.tmp"C:\Users\Admin\AppData\Local\Temp\5D2.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\65F.tmp"C:\Users\Admin\AppData\Local\Temp\65F.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\71A.tmp"C:\Users\Admin\AppData\Local\Temp\71A.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\797.tmp"C:\Users\Admin\AppData\Local\Temp\797.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5712 -
C:\Users\Admin\AppData\Local\Temp\863.tmp"C:\Users\Admin\AppData\Local\Temp\863.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\95D.tmp"C:\Users\Admin\AppData\Local\Temp\95D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\A28.tmp"C:\Users\Admin\AppData\Local\Temp\A28.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\AF3.tmp"C:\Users\Admin\AppData\Local\Temp\AF3.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5212 -
C:\Users\Admin\AppData\Local\Temp\B7F.tmp"C:\Users\Admin\AppData\Local\Temp\B7F.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\BFC.tmp"C:\Users\Admin\AppData\Local\Temp\BFC.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\C6A.tmp"C:\Users\Admin\AppData\Local\Temp\C6A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\CE7.tmp"C:\Users\Admin\AppData\Local\Temp\CE7.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\D73.tmp"C:\Users\Admin\AppData\Local\Temp\D73.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\E3F.tmp"C:\Users\Admin\AppData\Local\Temp\E3F.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Users\Admin\AppData\Local\Temp\EBC.tmp"C:\Users\Admin\AppData\Local\Temp\EBC.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\F39.tmp"C:\Users\Admin\AppData\Local\Temp\F39.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\FB6.tmp"C:\Users\Admin\AppData\Local\Temp\FB6.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\1042.tmp"C:\Users\Admin\AppData\Local\Temp\1042.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\10B0.tmp"C:\Users\Admin\AppData\Local\Temp\10B0.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\116B.tmp"C:\Users\Admin\AppData\Local\Temp\116B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\11D8.tmp"C:\Users\Admin\AppData\Local\Temp\11D8.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\1255.tmp"C:\Users\Admin\AppData\Local\Temp\1255.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\12F2.tmp"C:\Users\Admin\AppData\Local\Temp\12F2.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5852 -
C:\Users\Admin\AppData\Local\Temp\136F.tmp"C:\Users\Admin\AppData\Local\Temp\136F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\13EC.tmp"C:\Users\Admin\AppData\Local\Temp\13EC.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\1469.tmp"C:\Users\Admin\AppData\Local\Temp\1469.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\1515.tmp"C:\Users\Admin\AppData\Local\Temp\1515.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\15B1.tmp"C:\Users\Admin\AppData\Local\Temp\15B1.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\163D.tmp"C:\Users\Admin\AppData\Local\Temp\163D.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\16DA.tmp"C:\Users\Admin\AppData\Local\Temp\16DA.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\1757.tmp"C:\Users\Admin\AppData\Local\Temp\1757.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\17E3.tmp"C:\Users\Admin\AppData\Local\Temp\17E3.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\1AF1.tmp"C:\Users\Admin\AppData\Local\Temp\1AF1.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\1B7D.tmp"C:\Users\Admin\AppData\Local\Temp\1B7D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\1C19.tmp"C:\Users\Admin\AppData\Local\Temp\1C19.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\1C96.tmp"C:\Users\Admin\AppData\Local\Temp\1C96.tmp"65⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\1D42.tmp"C:\Users\Admin\AppData\Local\Temp\1D42.tmp"66⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\1DCF.tmp"C:\Users\Admin\AppData\Local\Temp\1DCF.tmp"67⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"C:\Users\Admin\AppData\Local\Temp\1E3C.tmp"68⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\1ED9.tmp"C:\Users\Admin\AppData\Local\Temp\1ED9.tmp"69⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\1F46.tmp"C:\Users\Admin\AppData\Local\Temp\1F46.tmp"70⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\1FC3.tmp"C:\Users\Admin\AppData\Local\Temp\1FC3.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\2040.tmp"C:\Users\Admin\AppData\Local\Temp\2040.tmp"72⤵PID:5408
-
C:\Users\Admin\AppData\Local\Temp\20CD.tmp"C:\Users\Admin\AppData\Local\Temp\20CD.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\2159.tmp"C:\Users\Admin\AppData\Local\Temp\2159.tmp"74⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\21F5.tmp"C:\Users\Admin\AppData\Local\Temp\21F5.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:764 -
C:\Users\Admin\AppData\Local\Temp\2282.tmp"C:\Users\Admin\AppData\Local\Temp\2282.tmp"76⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\230F.tmp"C:\Users\Admin\AppData\Local\Temp\230F.tmp"77⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\23BB.tmp"C:\Users\Admin\AppData\Local\Temp\23BB.tmp"78⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\2466.tmp"C:\Users\Admin\AppData\Local\Temp\2466.tmp"79⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\24F3.tmp"C:\Users\Admin\AppData\Local\Temp\24F3.tmp"80⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\259F.tmp"C:\Users\Admin\AppData\Local\Temp\259F.tmp"81⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\264B.tmp"C:\Users\Admin\AppData\Local\Temp\264B.tmp"82⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\26C8.tmp"C:\Users\Admin\AppData\Local\Temp\26C8.tmp"83⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\2754.tmp"C:\Users\Admin\AppData\Local\Temp\2754.tmp"84⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\27F1.tmp"C:\Users\Admin\AppData\Local\Temp\27F1.tmp"85⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\288D.tmp"C:\Users\Admin\AppData\Local\Temp\288D.tmp"86⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\291A.tmp"C:\Users\Admin\AppData\Local\Temp\291A.tmp"87⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\2997.tmp"C:\Users\Admin\AppData\Local\Temp\2997.tmp"88⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\2A23.tmp"C:\Users\Admin\AppData\Local\Temp\2A23.tmp"89⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\2ABF.tmp"C:\Users\Admin\AppData\Local\Temp\2ABF.tmp"90⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\2B3C.tmp"C:\Users\Admin\AppData\Local\Temp\2B3C.tmp"91⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\2BB9.tmp"C:\Users\Admin\AppData\Local\Temp\2BB9.tmp"92⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\2C36.tmp"C:\Users\Admin\AppData\Local\Temp\2C36.tmp"93⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\2CC3.tmp"C:\Users\Admin\AppData\Local\Temp\2CC3.tmp"94⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\2D40.tmp"C:\Users\Admin\AppData\Local\Temp\2D40.tmp"95⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\2DEC.tmp"C:\Users\Admin\AppData\Local\Temp\2DEC.tmp"96⤵
- System Location Discovery: System Language Discovery
PID:712 -
C:\Users\Admin\AppData\Local\Temp\2E69.tmp"C:\Users\Admin\AppData\Local\Temp\2E69.tmp"97⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\2EF6.tmp"C:\Users\Admin\AppData\Local\Temp\2EF6.tmp"98⤵PID:6068
-
C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"C:\Users\Admin\AppData\Local\Temp\2FA1.tmp"99⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\302E.tmp"C:\Users\Admin\AppData\Local\Temp\302E.tmp"100⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\30BB.tmp"C:\Users\Admin\AppData\Local\Temp\30BB.tmp"101⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\3147.tmp"C:\Users\Admin\AppData\Local\Temp\3147.tmp"102⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\31C4.tmp"C:\Users\Admin\AppData\Local\Temp\31C4.tmp"103⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\3261.tmp"C:\Users\Admin\AppData\Local\Temp\3261.tmp"104⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\330C.tmp"C:\Users\Admin\AppData\Local\Temp\330C.tmp"105⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\337A.tmp"C:\Users\Admin\AppData\Local\Temp\337A.tmp"106⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\33F7.tmp"C:\Users\Admin\AppData\Local\Temp\33F7.tmp"107⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\3483.tmp"C:\Users\Admin\AppData\Local\Temp\3483.tmp"108⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\34E1.tmp"C:\Users\Admin\AppData\Local\Temp\34E1.tmp"109⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\356E.tmp"C:\Users\Admin\AppData\Local\Temp\356E.tmp"110⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\360A.tmp"C:\Users\Admin\AppData\Local\Temp\360A.tmp"111⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\36B6.tmp"C:\Users\Admin\AppData\Local\Temp\36B6.tmp"112⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\3743.tmp"C:\Users\Admin\AppData\Local\Temp\3743.tmp"113⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\37B0.tmp"C:\Users\Admin\AppData\Local\Temp\37B0.tmp"114⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\383D.tmp"C:\Users\Admin\AppData\Local\Temp\383D.tmp"115⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\38D9.tmp"C:\Users\Admin\AppData\Local\Temp\38D9.tmp"116⤵PID:5956
-
C:\Users\Admin\AppData\Local\Temp\3956.tmp"C:\Users\Admin\AppData\Local\Temp\3956.tmp"117⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\39E2.tmp"C:\Users\Admin\AppData\Local\Temp\39E2.tmp"118⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"C:\Users\Admin\AppData\Local\Temp\3A5F.tmp"119⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\3AFC.tmp"C:\Users\Admin\AppData\Local\Temp\3AFC.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:6124 -
C:\Users\Admin\AppData\Local\Temp\3B88.tmp"C:\Users\Admin\AppData\Local\Temp\3B88.tmp"121⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\3BF6.tmp"C:\Users\Admin\AppData\Local\Temp\3BF6.tmp"122⤵PID:2448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-