Analysis
- max time kernel
132s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 03:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_32ff1626f47ac1f2de58056c3aabc645_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_32ff1626f47ac1f2de58056c3aabc645_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-02_32ff1626f47ac1f2de58056c3aabc645_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260802-dwgs2atbmf
- SHA256 2a35837ab953403bfac21f5d590b0c1ea3ffb0e41c64f9e3e9fa0ced84edf73a
- MD5 32ff1626f47ac1f2de58056c3aabc645
- SHA1 344fa3c2fcaa0fb2d555e92a87215e42ef1a7d88
- SHA512 8386a595c4273703d286924067db8d1229d222c0f586a751a2e1c5243bede0747874c3b1c1780c8490acf31ed52386664f5ebde6c618e46fdb41a0f6f4f57902
- SSDEEP 12288:9U5rCOTei6fBc5R1V505nKblmktEawPqZoXWjdq:9UQOJ6pER1VixKbt2PqqGh
- TLSH T19CC401217684C032E5A202354EE6EBB2697ABC715B22A4C77BC4777E2EB52D1D734307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 5452 A6F4.tmp 5048 A7B0.tmp 4724 A88B.tmp 2948 A9C3.tmp 2592 AA8E.tmp 5868 ABD6.tmp 6020 AC82.tmp 2904 AD2E.tmp 4220 AE18.tmp 4932 AEC4.tmp 5184 AF9F.tmp 1624 B04B.tmp 2132 B116.tmp 4296 B1B2.tmp 4332 B26E.tmp 1540 B2FA.tmp 6028 B3A6.tmp 4392 B471.tmp 6132 B4FE.tmp 4764 B57B.tmp 3440 B646.tmp 5696 B702.tmp 3244 B7AE.tmp 6140 B83A.tmp 2504 B8C7.tmp 2812 B982.tmp 2068 BA1F.tmp 2864 BABB.tmp 5068 BB96.tmp 5428 BC41.tmp 5332 BCDE.tmp 3192 BDA9.tmp 616 BE84.tmp 1336 BF10.tmp 1268 BF6E.tmp 5412 BFEB.tmp 3700 C068.tmp 2112 C0D5.tmp 3748 C133.tmp 1328 C1DF.tmp 5448 C26C.tmp 2692 C2E9.tmp 3204 C375.tmp 1644 C402.tmp 4864 C48E.tmp 472 C53A.tmp 932 C5A8.tmp 200 C625.tmp 3000 C6A2.tmp 3120 C70F.tmp 3932 C78C.tmp 5404 C7F9.tmp 4836 C876.tmp 4656 C8E4.tmp 5396 C980.tmp 4708 C9FD.tmp 5544 CA7A.tmp 4480 CAF7.tmp 2468 CB74.tmp 5160 CC01.tmp 2272 CC6E.tmp 4900 CCFB.tmp 2512 CD87.tmp 996 CE24.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6831.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8113.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E88C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A499.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2145.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 369D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8790.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 924.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2382.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F17A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ADC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5768.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 857D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E313.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F11D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 205A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5437.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5253.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 291.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7522.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A247.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 373E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F93B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEE.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 708 wrote to memory of 5452 708 2026-08-02_32ff1626f47ac1f2de58056c3aabc645_elex_mafia_stealc_tofsee.exe 88 PID 5452 wrote to memory of 5048 5452 A6F4.tmp 89 PID 5048 wrote to memory of 4724 5048 A7B0.tmp 90 PID 4724 wrote to memory of 2948 4724 A88B.tmp 91 PID 2948 wrote to memory of 2592 2948 A9C3.tmp 92 PID 2592 wrote to memory of 5868 2592 AA8E.tmp 93 PID 5868 wrote to memory of 6020 5868 ABD6.tmp 94 PID 6020 wrote to memory of 2904 6020 AC82.tmp 95 PID 2904 wrote to memory of 4220 2904 AD2E.tmp 96 PID 4220 wrote to memory of 4932 4220 AE18.tmp 97 PID 4932 wrote to memory of 5184 4932 AEC4.tmp 98 PID 5184 wrote to memory of 1624 5184 AF9F.tmp 99 PID 1624 wrote to memory of 2132 1624 B04B.tmp 100 PID 2132 wrote to memory of 4296 2132 B116.tmp 101 PID 4296 wrote to memory of 4332 4296 B1B2.tmp 102 PID 4332 wrote to memory of 1540 4332 B26E.tmp 103 PID 1540 wrote to memory of 6028 1540 B2FA.tmp 104 PID 6028 wrote to memory of 4392 6028 B3A6.tmp 105 PID 4392 wrote to memory of 6132 4392 B471.tmp 106 PID 6132 wrote to memory of 4764 6132 B4FE.tmp 107 PID 4764 wrote to memory of 3440 4764 B57B.tmp 108 PID 3440 wrote to memory of 5696 3440 B646.tmp 109 PID 5696 wrote to memory of 3244 5696 B702.tmp 110 PID 3244 wrote to memory of 6140 3244 B7AE.tmp 111 PID 6140 wrote to memory of 2504 6140 B83A.tmp 112 PID 2504 wrote to memory of 2812 2504 B8C7.tmp 113 PID 2812 wrote to memory of 2068 2812 B982.tmp 114 PID 2068 wrote to memory of 2864 2068 BA1F.tmp 115 PID 2864 wrote to memory of 5068 2864 BABB.tmp 116 PID 5068 wrote to memory of 5428 5068 BB96.tmp 117 PID 5428 wrote to memory of 5332 5428 BC41.tmp 118 PID 5332 wrote to memory of 3192 5332 BCDE.tmp 119 PID 3192 wrote to memory of 616 3192 BDA9.tmp 120 PID 616 wrote to memory of 1336 616 BE84.tmp 121 PID 1336 wrote to memory of 1268 1336 BF10.tmp 122 PID 1268 wrote to memory of 5412 1268 BF6E.tmp 123 PID 5412 wrote to memory of 3700 5412 BFEB.tmp 124 PID 3700 wrote to memory of 2112 3700 C068.tmp 125 PID 2112 wrote to memory of 3748 2112 C0D5.tmp 126 PID 3748 wrote to memory of 1328 3748 C133.tmp 127 PID 1328 wrote to memory of 5448 1328 C1DF.tmp 128 PID 5448 wrote to memory of 2692 5448 C26C.tmp 129 PID 2692 wrote to memory of 3204 2692 C2E9.tmp 130 PID 3204 wrote to memory of 1644 3204 C375.tmp 131 PID 1644 wrote to memory of 4864 1644 C402.tmp 132 PID 4864 wrote to memory of 472 4864 C48E.tmp 133 PID 472 wrote to memory of 932 472 C53A.tmp 134 PID 932 wrote to memory of 200 932 C5A8.tmp 135 PID 200 wrote to memory of 3000 200 C625.tmp 136 PID 3000 wrote to memory of 3120 3000 C6A2.tmp 137 PID 3120 wrote to memory of 3932 3120 C70F.tmp 138 PID 3932 wrote to memory of 5404 3932 C78C.tmp 139 PID 5404 wrote to memory of 4836 5404 C7F9.tmp 140 PID 4836 wrote to memory of 4656 4836 C876.tmp 141 PID 4656 wrote to memory of 5396 4656 C8E4.tmp 142 PID 5396 wrote to memory of 4708 5396 C980.tmp 143 PID 4708 wrote to memory of 5544 4708 C9FD.tmp 144 PID 5544 wrote to memory of 4480 5544 CA7A.tmp 145 PID 4480 wrote to memory of 2468 4480 CAF7.tmp 146 PID 2468 wrote to memory of 5160 2468 CB74.tmp 147 PID 5160 wrote to memory of 2272 5160 CC01.tmp 148 PID 2272 wrote to memory of 4900 2272 CC6E.tmp 149 PID 4900 wrote to memory of 2512 4900 CCFB.tmp 150 PID 2512 wrote to memory of 996 2512 CD87.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_32ff1626f47ac1f2de58056c3aabc645_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_32ff1626f47ac1f2de58056c3aabc645_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\A6F4.tmp"C:\Users\Admin\AppData\Local\Temp\A6F4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"C:\Users\Admin\AppData\Local\Temp\A7B0.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\A88B.tmp"C:\Users\Admin\AppData\Local\Temp\A88B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\A9C3.tmp"C:\Users\Admin\AppData\Local\Temp\A9C3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\AA8E.tmp"C:\Users\Admin\AppData\Local\Temp\AA8E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\ABD6.tmp"C:\Users\Admin\AppData\Local\Temp\ABD6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5868 -
C:\Users\Admin\AppData\Local\Temp\AC82.tmp"C:\Users\Admin\AppData\Local\Temp\AC82.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Users\Admin\AppData\Local\Temp\AD2E.tmp"C:\Users\Admin\AppData\Local\Temp\AD2E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\AE18.tmp"C:\Users\Admin\AppData\Local\Temp\AE18.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\AEC4.tmp"C:\Users\Admin\AppData\Local\Temp\AEC4.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"C:\Users\Admin\AppData\Local\Temp\AF9F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Users\Admin\AppData\Local\Temp\B04B.tmp"C:\Users\Admin\AppData\Local\Temp\B04B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\B116.tmp"C:\Users\Admin\AppData\Local\Temp\B116.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\B1B2.tmp"C:\Users\Admin\AppData\Local\Temp\B1B2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\B4FE.tmp"C:\Users\Admin\AppData\Local\Temp\B4FE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\B57B.tmp"C:\Users\Admin\AppData\Local\Temp\B57B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\B646.tmp"C:\Users\Admin\AppData\Local\Temp\B646.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\B702.tmp"C:\Users\Admin\AppData\Local\Temp\B702.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5696 -
C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"C:\Users\Admin\AppData\Local\Temp\B7AE.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\B83A.tmp"C:\Users\Admin\AppData\Local\Temp\B83A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\B8C7.tmp"C:\Users\Admin\AppData\Local\Temp\B8C7.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\B982.tmp"C:\Users\Admin\AppData\Local\Temp\B982.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\BA1F.tmp"C:\Users\Admin\AppData\Local\Temp\BA1F.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\BABB.tmp"C:\Users\Admin\AppData\Local\Temp\BABB.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\BB96.tmp"C:\Users\Admin\AppData\Local\Temp\BB96.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\BC41.tmp"C:\Users\Admin\AppData\Local\Temp\BC41.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5428 -
C:\Users\Admin\AppData\Local\Temp\BCDE.tmp"C:\Users\Admin\AppData\Local\Temp\BCDE.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
C:\Users\Admin\AppData\Local\Temp\BDA9.tmp"C:\Users\Admin\AppData\Local\Temp\BDA9.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\BE84.tmp"C:\Users\Admin\AppData\Local\Temp\BE84.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\BF10.tmp"C:\Users\Admin\AppData\Local\Temp\BF10.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\BF6E.tmp"C:\Users\Admin\AppData\Local\Temp\BF6E.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"C:\Users\Admin\AppData\Local\Temp\BFEB.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Users\Admin\AppData\Local\Temp\C068.tmp"C:\Users\Admin\AppData\Local\Temp\C068.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"C:\Users\Admin\AppData\Local\Temp\C0D5.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\C133.tmp"C:\Users\Admin\AppData\Local\Temp\C133.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"C:\Users\Admin\AppData\Local\Temp\C1DF.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\C26C.tmp"C:\Users\Admin\AppData\Local\Temp\C26C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\C375.tmp"C:\Users\Admin\AppData\Local\Temp\C375.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\C402.tmp"C:\Users\Admin\AppData\Local\Temp\C402.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\C48E.tmp"C:\Users\Admin\AppData\Local\Temp\C48E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\C53A.tmp"C:\Users\Admin\AppData\Local\Temp\C53A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"C:\Users\Admin\AppData\Local\Temp\C5A8.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\C625.tmp"C:\Users\Admin\AppData\Local\Temp\C625.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Users\Admin\AppData\Local\Temp\C6A2.tmp"C:\Users\Admin\AppData\Local\Temp\C6A2.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\C70F.tmp"C:\Users\Admin\AppData\Local\Temp\C70F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\C78C.tmp"C:\Users\Admin\AppData\Local\Temp\C78C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\C7F9.tmp"C:\Users\Admin\AppData\Local\Temp\C7F9.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Users\Admin\AppData\Local\Temp\C876.tmp"C:\Users\Admin\AppData\Local\Temp\C876.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"C:\Users\Admin\AppData\Local\Temp\C8E4.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\C980.tmp"C:\Users\Admin\AppData\Local\Temp\C980.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"C:\Users\Admin\AppData\Local\Temp\C9FD.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\CA7A.tmp"C:\Users\Admin\AppData\Local\Temp\CA7A.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\CAF7.tmp"C:\Users\Admin\AppData\Local\Temp\CAF7.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\CB74.tmp"C:\Users\Admin\AppData\Local\Temp\CB74.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\CC01.tmp"C:\Users\Admin\AppData\Local\Temp\CC01.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\CC6E.tmp"C:\Users\Admin\AppData\Local\Temp\CC6E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\CCFB.tmp"C:\Users\Admin\AppData\Local\Temp\CCFB.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\CD87.tmp"C:\Users\Admin\AppData\Local\Temp\CD87.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\CE24.tmp"C:\Users\Admin\AppData\Local\Temp\CE24.tmp"65⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"C:\Users\Admin\AppData\Local\Temp\CEA1.tmp"66⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\CF0E.tmp"C:\Users\Admin\AppData\Local\Temp\CF0E.tmp"67⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\CF9B.tmp"C:\Users\Admin\AppData\Local\Temp\CF9B.tmp"68⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\D027.tmp"C:\Users\Admin\AppData\Local\Temp\D027.tmp"69⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\D0B4.tmp"C:\Users\Admin\AppData\Local\Temp\D0B4.tmp"70⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\D121.tmp"C:\Users\Admin\AppData\Local\Temp\D121.tmp"71⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\D18F.tmp"C:\Users\Admin\AppData\Local\Temp\D18F.tmp"72⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\D20C.tmp"C:\Users\Admin\AppData\Local\Temp\D20C.tmp"73⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\D298.tmp"C:\Users\Admin\AppData\Local\Temp\D298.tmp"74⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\D344.tmp"C:\Users\Admin\AppData\Local\Temp\D344.tmp"75⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\D3B1.tmp"C:\Users\Admin\AppData\Local\Temp\D3B1.tmp"76⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\D43E.tmp"C:\Users\Admin\AppData\Local\Temp\D43E.tmp"77⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\D4BB.tmp"C:\Users\Admin\AppData\Local\Temp\D4BB.tmp"78⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\D528.tmp"C:\Users\Admin\AppData\Local\Temp\D528.tmp"79⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\D5B5.tmp"C:\Users\Admin\AppData\Local\Temp\D5B5.tmp"80⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\D632.tmp"C:\Users\Admin\AppData\Local\Temp\D632.tmp"81⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"C:\Users\Admin\AppData\Local\Temp\D6BF.tmp"82⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\D74B.tmp"C:\Users\Admin\AppData\Local\Temp\D74B.tmp"83⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\D7C8.tmp"C:\Users\Admin\AppData\Local\Temp\D7C8.tmp"84⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\D836.tmp"C:\Users\Admin\AppData\Local\Temp\D836.tmp"85⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"86⤵PID:6120
-
C:\Users\Admin\AppData\Local\Temp\D930.tmp"C:\Users\Admin\AppData\Local\Temp\D930.tmp"87⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"C:\Users\Admin\AppData\Local\Temp\D9AD.tmp"88⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\DA2A.tmp"C:\Users\Admin\AppData\Local\Temp\DA2A.tmp"89⤵PID:6136
-
C:\Users\Admin\AppData\Local\Temp\DA97.tmp"C:\Users\Admin\AppData\Local\Temp\DA97.tmp"90⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\DB14.tmp"C:\Users\Admin\AppData\Local\Temp\DB14.tmp"91⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\DBA1.tmp"C:\Users\Admin\AppData\Local\Temp\DBA1.tmp"92⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\DC0E.tmp"C:\Users\Admin\AppData\Local\Temp\DC0E.tmp"93⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\DCAA.tmp"C:\Users\Admin\AppData\Local\Temp\DCAA.tmp"94⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\DD56.tmp"C:\Users\Admin\AppData\Local\Temp\DD56.tmp"95⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\DDE3.tmp"C:\Users\Admin\AppData\Local\Temp\DDE3.tmp"96⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\DE60.tmp"C:\Users\Admin\AppData\Local\Temp\DE60.tmp"97⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\DEDD.tmp"C:\Users\Admin\AppData\Local\Temp\DEDD.tmp"98⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\DF69.tmp"C:\Users\Admin\AppData\Local\Temp\DF69.tmp"99⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"C:\Users\Admin\AppData\Local\Temp\DFE6.tmp"100⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\E054.tmp"C:\Users\Admin\AppData\Local\Temp\E054.tmp"101⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"C:\Users\Admin\AppData\Local\Temp\E0C1.tmp"102⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\E13E.tmp"C:\Users\Admin\AppData\Local\Temp\E13E.tmp"103⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"C:\Users\Admin\AppData\Local\Temp\E1BB.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\E238.tmp"C:\Users\Admin\AppData\Local\Temp\E238.tmp"105⤵PID:5604
-
C:\Users\Admin\AppData\Local\Temp\E2A6.tmp"C:\Users\Admin\AppData\Local\Temp\E2A6.tmp"106⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\E313.tmp"C:\Users\Admin\AppData\Local\Temp\E313.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:716 -
C:\Users\Admin\AppData\Local\Temp\E390.tmp"C:\Users\Admin\AppData\Local\Temp\E390.tmp"108⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\E40D.tmp"C:\Users\Admin\AppData\Local\Temp\E40D.tmp"109⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\E48A.tmp"C:\Users\Admin\AppData\Local\Temp\E48A.tmp"110⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\E536.tmp"C:\Users\Admin\AppData\Local\Temp\E536.tmp"111⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\E5B3.tmp"C:\Users\Admin\AppData\Local\Temp\E5B3.tmp"112⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\E64F.tmp"C:\Users\Admin\AppData\Local\Temp\E64F.tmp"113⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\E6CC.tmp"C:\Users\Admin\AppData\Local\Temp\E6CC.tmp"114⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\E759.tmp"C:\Users\Admin\AppData\Local\Temp\E759.tmp"115⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\E7E5.tmp"C:\Users\Admin\AppData\Local\Temp\E7E5.tmp"116⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\E862.tmp"C:\Users\Admin\AppData\Local\Temp\E862.tmp"117⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\E8EF.tmp"C:\Users\Admin\AppData\Local\Temp\E8EF.tmp"118⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\E97C.tmp"C:\Users\Admin\AppData\Local\Temp\E97C.tmp"119⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\EA08.tmp"C:\Users\Admin\AppData\Local\Temp\EA08.tmp"120⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\EA95.tmp"C:\Users\Admin\AppData\Local\Temp\EA95.tmp"121⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\EB02.tmp"C:\Users\Admin\AppData\Local\Temp\EB02.tmp"122⤵PID:5300
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-