Analysis
- max time kernel
119s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 14:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_3cf0289b75385f489fcf16e2876eb137_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_3cf0289b75385f489fcf16e2876eb137_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_3cf0289b75385f489fcf16e2876eb137_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260802-ryrmxabq5w
- SHA256 366183ce2d0b2a9d79e1d8b8df210fb50ed52882634fb31ca5f507d525571bc7
- MD5 3cf0289b75385f489fcf16e2876eb137
- SHA1 1f2a65869c6592f8d8b4e8720c8f520416e523a4
- SHA512 cef21dc2a9900f21ee4f17f8eeaf76a8ee49fbd644606e9e77dd74a30e20947a93c032c446010daaf4e6ae0aaeb7c17137c6721a567b4c6e8486f679b92a8636
- SSDEEP 12288:NU5rCOTeijL0E8ZBaQE/AXNsT+d0l0q22z4wTqQ9TZwlH:NUQOJj9cBjnNMqtQ48qQ9TSlH
- TLSH T160B4F125B644C133E6D202710FE6EBA22A3A7C355726A4C73794636E2FB52E1E774307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1716 84F5.tmp 5104 85C0.tmp 3472 86BA.tmp 2700 8757.tmp 2824 8851.tmp 5888 89D7.tmp 4624 8AC2.tmp 2740 8B7D.tmp 5956 8C39.tmp 2668 8CB6.tmp 4652 8DB0.tmp 2060 8E8A.tmp 2876 8F36.tmp 612 8FE2.tmp 5192 908E.tmp 1280 912A.tmp 4656 91E6.tmp 2228 92B1.tmp 1004 935D.tmp 2396 93DA.tmp 1500 9457.tmp 1548 94F3.tmp 2984 95AE.tmp 4588 967A.tmp 2108 9716.tmp 3668 97B2.tmp 4712 986E.tmp 1780 9919.tmp 2680 99B6.tmp 2480 9A90.tmp 3500 9B3C.tmp 6072 9BF8.tmp 2696 9C84.tmp 1828 9CF2.tmp 2752 9D8E.tmp 1792 9DFB.tmp 2196 9E88.tmp 4472 9EF5.tmp 700 9F53.tmp 4512 9FC1.tmp 2372 A05D.tmp 5560 A0DA.tmp 1040 A147.tmp 4612 A1D4.tmp 6112 A251.tmp 1368 A2DD.tmp 5656 A35A.tmp 3324 A3E7.tmp 2456 A474.tmp 5392 A4E1.tmp 2492 A54E.tmp 2000 A5DB.tmp 1564 A687.tmp 5880 A714.tmp 2552 A7BF.tmp 4100 A88B.tmp 3132 A946.tmp 1748 A9E2.tmp 6064 AA6F.tmp 5884 AAEC.tmp 4260 ABE6.tmp 5396 AC63.tmp 1236 ACE0.tmp 3644 AD6D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 322D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 851F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 444E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 612C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E872.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 256B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4670.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C92D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9457.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 638E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B509.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E233.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_3cf0289b75385f489fcf16e2876eb137_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2183.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A21D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A251.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3896.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 319C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D265.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E744.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 103D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B78A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1272 wrote to memory of 1716 1272 2026-08-02_3cf0289b75385f489fcf16e2876eb137_elex_mafia_stealc_tofsee.exe 90 PID 1716 wrote to memory of 5104 1716 84F5.tmp 91 PID 5104 wrote to memory of 3472 5104 85C0.tmp 92 PID 3472 wrote to memory of 2700 3472 86BA.tmp 93 PID 2700 wrote to memory of 2824 2700 8757.tmp 94 PID 2824 wrote to memory of 5888 2824 8851.tmp 95 PID 5888 wrote to memory of 4624 5888 89D7.tmp 96 PID 4624 wrote to memory of 2740 4624 8AC2.tmp 97 PID 2740 wrote to memory of 5956 2740 8B7D.tmp 98 PID 5956 wrote to memory of 2668 5956 8C39.tmp 99 PID 2668 wrote to memory of 4652 2668 8CB6.tmp 100 PID 4652 wrote to memory of 2060 4652 8DB0.tmp 101 PID 2060 wrote to memory of 2876 2060 8E8A.tmp 102 PID 2876 wrote to memory of 612 2876 8F36.tmp 103 PID 612 wrote to memory of 5192 612 8FE2.tmp 104 PID 5192 wrote to memory of 1280 5192 908E.tmp 105 PID 1280 wrote to memory of 4656 1280 912A.tmp 106 PID 4656 wrote to memory of 2228 4656 91E6.tmp 107 PID 2228 wrote to memory of 1004 2228 92B1.tmp 108 PID 1004 wrote to memory of 2396 1004 935D.tmp 109 PID 2396 wrote to memory of 1500 2396 93DA.tmp 110 PID 1500 wrote to memory of 1548 1500 9457.tmp 111 PID 1548 wrote to memory of 2984 1548 94F3.tmp 112 PID 2984 wrote to memory of 4588 2984 95AE.tmp 113 PID 4588 wrote to memory of 2108 4588 967A.tmp 114 PID 2108 wrote to memory of 3668 2108 9716.tmp 115 PID 3668 wrote to memory of 4712 3668 97B2.tmp 116 PID 4712 wrote to memory of 1780 4712 986E.tmp 117 PID 1780 wrote to memory of 2680 1780 9919.tmp 118 PID 2680 wrote to memory of 2480 2680 99B6.tmp 119 PID 2480 wrote to memory of 3500 2480 9A90.tmp 120 PID 3500 wrote to memory of 6072 3500 9B3C.tmp 121 PID 6072 wrote to memory of 2696 6072 9BF8.tmp 122 PID 2696 wrote to memory of 1828 2696 9C84.tmp 123 PID 1828 wrote to memory of 2752 1828 9CF2.tmp 124 PID 2752 wrote to memory of 1792 2752 9D8E.tmp 125 PID 1792 wrote to memory of 2196 1792 9DFB.tmp 126 PID 2196 wrote to memory of 4472 2196 9E88.tmp 127 PID 4472 wrote to memory of 700 4472 9EF5.tmp 128 PID 700 wrote to memory of 4512 700 9F53.tmp 129 PID 4512 wrote to memory of 2372 4512 9FC1.tmp 130 PID 2372 wrote to memory of 5560 2372 A05D.tmp 131 PID 5560 wrote to memory of 1040 5560 A0DA.tmp 132 PID 1040 wrote to memory of 4612 1040 A147.tmp 133 PID 4612 wrote to memory of 6112 4612 A1D4.tmp 134 PID 6112 wrote to memory of 1368 6112 A251.tmp 135 PID 1368 wrote to memory of 5656 1368 A2DD.tmp 136 PID 5656 wrote to memory of 3324 5656 A35A.tmp 137 PID 3324 wrote to memory of 2456 3324 A3E7.tmp 138 PID 2456 wrote to memory of 5392 2456 A474.tmp 139 PID 5392 wrote to memory of 2492 5392 A4E1.tmp 140 PID 2492 wrote to memory of 2000 2492 A54E.tmp 141 PID 2000 wrote to memory of 1564 2000 A5DB.tmp 142 PID 1564 wrote to memory of 5880 1564 A687.tmp 143 PID 5880 wrote to memory of 2552 5880 A714.tmp 144 PID 2552 wrote to memory of 4100 2552 A7BF.tmp 145 PID 4100 wrote to memory of 3132 4100 A88B.tmp 146 PID 3132 wrote to memory of 1748 3132 A946.tmp 147 PID 1748 wrote to memory of 6064 1748 A9E2.tmp 148 PID 6064 wrote to memory of 5884 6064 AA6F.tmp 149 PID 976 wrote to memory of 4260 976 AB79.tmp 151 PID 4260 wrote to memory of 5396 4260 ABE6.tmp 152 PID 5396 wrote to memory of 1236 5396 AC63.tmp 153 PID 1236 wrote to memory of 3644 1236 ACE0.tmp 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_3cf0289b75385f489fcf16e2876eb137_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_3cf0289b75385f489fcf16e2876eb137_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\84F5.tmp"C:\Users\Admin\AppData\Local\Temp\84F5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\85C0.tmp"C:\Users\Admin\AppData\Local\Temp\85C0.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\86BA.tmp"C:\Users\Admin\AppData\Local\Temp\86BA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\8757.tmp"C:\Users\Admin\AppData\Local\Temp\8757.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\8851.tmp"C:\Users\Admin\AppData\Local\Temp\8851.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\89D7.tmp"C:\Users\Admin\AppData\Local\Temp\89D7.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\8C39.tmp"C:\Users\Admin\AppData\Local\Temp\8C39.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5956 -
C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"C:\Users\Admin\AppData\Local\Temp\8CB6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\8DB0.tmp"C:\Users\Admin\AppData\Local\Temp\8DB0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\8E8A.tmp"C:\Users\Admin\AppData\Local\Temp\8E8A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\8F36.tmp"C:\Users\Admin\AppData\Local\Temp\8F36.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\8FE2.tmp"C:\Users\Admin\AppData\Local\Temp\8FE2.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Local\Temp\908E.tmp"C:\Users\Admin\AppData\Local\Temp\908E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5192 -
C:\Users\Admin\AppData\Local\Temp\912A.tmp"C:\Users\Admin\AppData\Local\Temp\912A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\91E6.tmp"C:\Users\Admin\AppData\Local\Temp\91E6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\92B1.tmp"C:\Users\Admin\AppData\Local\Temp\92B1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\935D.tmp"C:\Users\Admin\AppData\Local\Temp\935D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\93DA.tmp"C:\Users\Admin\AppData\Local\Temp\93DA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\9457.tmp"C:\Users\Admin\AppData\Local\Temp\9457.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\94F3.tmp"C:\Users\Admin\AppData\Local\Temp\94F3.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\95AE.tmp"C:\Users\Admin\AppData\Local\Temp\95AE.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\967A.tmp"C:\Users\Admin\AppData\Local\Temp\967A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\9716.tmp"C:\Users\Admin\AppData\Local\Temp\9716.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\97B2.tmp"C:\Users\Admin\AppData\Local\Temp\97B2.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\986E.tmp"C:\Users\Admin\AppData\Local\Temp\986E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\9919.tmp"C:\Users\Admin\AppData\Local\Temp\9919.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\99B6.tmp"C:\Users\Admin\AppData\Local\Temp\99B6.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\9A90.tmp"C:\Users\Admin\AppData\Local\Temp\9A90.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\9B3C.tmp"C:\Users\Admin\AppData\Local\Temp\9B3C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\9BF8.tmp"C:\Users\Admin\AppData\Local\Temp\9BF8.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\9C84.tmp"C:\Users\Admin\AppData\Local\Temp\9C84.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\9CF2.tmp"C:\Users\Admin\AppData\Local\Temp\9CF2.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"C:\Users\Admin\AppData\Local\Temp\9D8E.tmp"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\9DFB.tmp"C:\Users\Admin\AppData\Local\Temp\9DFB.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\9E88.tmp"C:\Users\Admin\AppData\Local\Temp\9E88.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\9EF5.tmp"C:\Users\Admin\AppData\Local\Temp\9EF5.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\9F53.tmp"C:\Users\Admin\AppData\Local\Temp\9F53.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\9FC1.tmp"C:\Users\Admin\AppData\Local\Temp\9FC1.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\A05D.tmp"C:\Users\Admin\AppData\Local\Temp\A05D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\A0DA.tmp"C:\Users\Admin\AppData\Local\Temp\A0DA.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Users\Admin\AppData\Local\Temp\A147.tmp"C:\Users\Admin\AppData\Local\Temp\A147.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\A1D4.tmp"C:\Users\Admin\AppData\Local\Temp\A1D4.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\A251.tmp"C:\Users\Admin\AppData\Local\Temp\A251.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Users\Admin\AppData\Local\Temp\A2DD.tmp"C:\Users\Admin\AppData\Local\Temp\A2DD.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\A35A.tmp"C:\Users\Admin\AppData\Local\Temp\A35A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Temp\A3E7.tmp"C:\Users\Admin\AppData\Local\Temp\A3E7.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\A474.tmp"C:\Users\Admin\AppData\Local\Temp\A474.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"C:\Users\Admin\AppData\Local\Temp\A4E1.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\A54E.tmp"C:\Users\Admin\AppData\Local\Temp\A54E.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\A5DB.tmp"C:\Users\Admin\AppData\Local\Temp\A5DB.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\A687.tmp"C:\Users\Admin\AppData\Local\Temp\A687.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\A714.tmp"C:\Users\Admin\AppData\Local\Temp\A714.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Users\Admin\AppData\Local\Temp\A7BF.tmp"C:\Users\Admin\AppData\Local\Temp\A7BF.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\A88B.tmp"C:\Users\Admin\AppData\Local\Temp\A88B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\A946.tmp"C:\Users\Admin\AppData\Local\Temp\A946.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"C:\Users\Admin\AppData\Local\Temp\A9E2.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\AA6F.tmp"C:\Users\Admin\AppData\Local\Temp\AA6F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"C:\Users\Admin\AppData\Local\Temp\AAEC.tmp"61⤵
- Executes dropped EXE
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\AB79.tmp"C:\Users\Admin\AppData\Local\Temp\AB79.tmp"62⤵
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"C:\Users\Admin\AppData\Local\Temp\ABE6.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\AC63.tmp"C:\Users\Admin\AppData\Local\Temp\AC63.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Users\Admin\AppData\Local\Temp\ACE0.tmp"C:\Users\Admin\AppData\Local\Temp\ACE0.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"C:\Users\Admin\AppData\Local\Temp\AD6D.tmp"66⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\ADF9.tmp"C:\Users\Admin\AppData\Local\Temp\ADF9.tmp"67⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\AE86.tmp"C:\Users\Admin\AppData\Local\Temp\AE86.tmp"68⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\AF12.tmp"C:\Users\Admin\AppData\Local\Temp\AF12.tmp"69⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\AF80.tmp"C:\Users\Admin\AppData\Local\Temp\AF80.tmp"70⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\B03B.tmp"C:\Users\Admin\AppData\Local\Temp\B03B.tmp"71⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\B0B8.tmp"C:\Users\Admin\AppData\Local\Temp\B0B8.tmp"72⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\B135.tmp"C:\Users\Admin\AppData\Local\Temp\B135.tmp"73⤵PID:5296
-
C:\Users\Admin\AppData\Local\Temp\B220.tmp"C:\Users\Admin\AppData\Local\Temp\B220.tmp"74⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"75⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\B349.tmp"C:\Users\Admin\AppData\Local\Temp\B349.tmp"76⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"77⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\B491.tmp"C:\Users\Admin\AppData\Local\Temp\B491.tmp"78⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\B51D.tmp"C:\Users\Admin\AppData\Local\Temp\B51D.tmp"79⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"C:\Users\Admin\AppData\Local\Temp\B5C9.tmp"80⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\B627.tmp"C:\Users\Admin\AppData\Local\Temp\B627.tmp"81⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"C:\Users\Admin\AppData\Local\Temp\B6B4.tmp"82⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\B740.tmp"C:\Users\Admin\AppData\Local\Temp\B740.tmp"83⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\B7BD.tmp"C:\Users\Admin\AppData\Local\Temp\B7BD.tmp"84⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\B83A.tmp"C:\Users\Admin\AppData\Local\Temp\B83A.tmp"85⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"C:\Users\Admin\AppData\Local\Temp\B8A8.tmp"86⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\B963.tmp"C:\Users\Admin\AppData\Local\Temp\B963.tmp"87⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\B9E0.tmp"C:\Users\Admin\AppData\Local\Temp\B9E0.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\BA7C.tmp"C:\Users\Admin\AppData\Local\Temp\BA7C.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\BAF9.tmp"C:\Users\Admin\AppData\Local\Temp\BAF9.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\BB96.tmp"C:\Users\Admin\AppData\Local\Temp\BB96.tmp"91⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\BC22.tmp"C:\Users\Admin\AppData\Local\Temp\BC22.tmp"92⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\BC9F.tmp"C:\Users\Admin\AppData\Local\Temp\BC9F.tmp"93⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"C:\Users\Admin\AppData\Local\Temp\BD0D.tmp"94⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\BD99.tmp"C:\Users\Admin\AppData\Local\Temp\BD99.tmp"95⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\BE07.tmp"C:\Users\Admin\AppData\Local\Temp\BE07.tmp"96⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\BE74.tmp"C:\Users\Admin\AppData\Local\Temp\BE74.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\BEF1.tmp"C:\Users\Admin\AppData\Local\Temp\BEF1.tmp"98⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\BF9D.tmp"C:\Users\Admin\AppData\Local\Temp\BF9D.tmp"99⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\C029.tmp"C:\Users\Admin\AppData\Local\Temp\C029.tmp"100⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\C0A6.tmp"C:\Users\Admin\AppData\Local\Temp\C0A6.tmp"101⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\C123.tmp"C:\Users\Admin\AppData\Local\Temp\C123.tmp"102⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\C1B0.tmp"C:\Users\Admin\AppData\Local\Temp\C1B0.tmp"103⤵PID:5664
-
C:\Users\Admin\AppData\Local\Temp\C23D.tmp"C:\Users\Admin\AppData\Local\Temp\C23D.tmp"104⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"C:\Users\Admin\AppData\Local\Temp\C2E9.tmp"105⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\C385.tmp"C:\Users\Admin\AppData\Local\Temp\C385.tmp"106⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\C440.tmp"C:\Users\Admin\AppData\Local\Temp\C440.tmp"107⤵PID:5824
-
C:\Users\Admin\AppData\Local\Temp\C4EC.tmp"C:\Users\Admin\AppData\Local\Temp\C4EC.tmp"108⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\C579.tmp"C:\Users\Admin\AppData\Local\Temp\C579.tmp"109⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\C605.tmp"C:\Users\Admin\AppData\Local\Temp\C605.tmp"110⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\C692.tmp"C:\Users\Admin\AppData\Local\Temp\C692.tmp"111⤵PID:6128
-
C:\Users\Admin\AppData\Local\Temp\C70F.tmp"C:\Users\Admin\AppData\Local\Temp\C70F.tmp"112⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\C78C.tmp"C:\Users\Admin\AppData\Local\Temp\C78C.tmp"113⤵PID:5528
-
C:\Users\Admin\AppData\Local\Temp\C809.tmp"C:\Users\Admin\AppData\Local\Temp\C809.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\C8A5.tmp"C:\Users\Admin\AppData\Local\Temp\C8A5.tmp"115⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\C932.tmp"C:\Users\Admin\AppData\Local\Temp\C932.tmp"116⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\C9BF.tmp"C:\Users\Admin\AppData\Local\Temp\C9BF.tmp"117⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\CA3C.tmp"C:\Users\Admin\AppData\Local\Temp\CA3C.tmp"118⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\CAD8.tmp"C:\Users\Admin\AppData\Local\Temp\CAD8.tmp"119⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\CB55.tmp"C:\Users\Admin\AppData\Local\Temp\CB55.tmp"120⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\CBE1.tmp"C:\Users\Admin\AppData\Local\Temp\CBE1.tmp"121⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\CC6E.tmp"C:\Users\Admin\AppData\Local\Temp\CC6E.tmp"122⤵PID:3260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-