Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 02:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_06344c2b86c07eb38fe0cf01acf8d200_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_06344c2b86c07eb38fe0cf01acf8d200_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-29_06344c2b86c07eb38fe0cf01acf8d200_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260730-ch9ffsbm2z
- SHA256 b594778e94c92e9969f7e736ef2afa9d1a4277317114b7e37059cd1abf823dc7
- MD5 06344c2b86c07eb38fe0cf01acf8d200
- SHA1 6c81d4800f4d097da2c1960fb91f0bd254c6d752
- SHA512 98e79df6908b05e50a5388521163ca06213538781ebaa57fa5c3d2a24bffaec9f8ff461d769e5fdbc1ce23f93def9f6568f2ae2baf62caa8dd3de7c2f57d70bc
- SSDEEP 12288:wU5rCOTeiDMqgL62YCHJWMknNbUsOWhDZYD7q+iZONZ+3/v+I9hUG2VA:wUQOJDAL62YguKDW9ZY/UENGEA
- TLSH T15AE4D02173D8C532E5FB037859B5E6514D7EBD22A722D6CF6F8016AE09B1BD08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3240 2006.tmp 468 212F.tmp 4676 2248.tmp 1848 23DF.tmp 4316 2507.tmp 1796 25E2.tmp 1092 272A.tmp 2408 2824.tmp 4456 295D.tmp 1836 2A57.tmp 2024 2B32.tmp 2992 2C3B.tmp 1992 2D35.tmp 4076 2E4E.tmp 1540 2F58.tmp 3912 3071.tmp 4744 316B.tmp 224 3265.tmp 2032 3350.tmp 3104 34B7.tmp 2708 35B1.tmp 3624 36AB.tmp 3000 37A5.tmp 4580 38BE.tmp 4440 39E7.tmp 1448 3AE1.tmp 4972 3C0A.tmp 4112 3CF4.tmp 4368 3E0E.tmp 776 3ED9.tmp 1536 3FD3.tmp 1680 40CD.tmp 4632 41B7.tmp 4336 4253.tmp 1964 42E0.tmp 2920 436D.tmp 2952 43EA.tmp 5092 4476.tmp 3712 4503.tmp 3224 459F.tmp 2940 464B.tmp 3992 46E7.tmp 2528 4755.tmp 2840 4801.tmp 3328 489D.tmp 2536 4939.tmp 4760 4A04.tmp 4220 4AA0.tmp 3464 4B0E.tmp 920 4B6C.tmp 1752 4BD9.tmp 3928 4C37.tmp 2260 4C94.tmp 1028 4CE3.tmp 548 4D50.tmp 1780 4D9E.tmp 2124 4DEC.tmp 4328 4E4A.tmp 4904 4EB7.tmp 4404 4F15.tmp 3068 4F82.tmp 4296 4FE0.tmp 3444 503E.tmp 1440 50BB.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2507.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D618.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5191.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7843.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 905F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 983F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C990.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E27B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 648C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2580.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F25A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4954.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B10B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 558D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F48C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D31A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3994.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4716 wrote to memory of 3240 4716 2026-07-29_06344c2b86c07eb38fe0cf01acf8d200_elex_mafia_stealc_tofsee.exe 85 PID 3240 wrote to memory of 468 3240 2006.tmp 86 PID 468 wrote to memory of 4676 468 212F.tmp 87 PID 4676 wrote to memory of 1848 4676 2248.tmp 88 PID 1848 wrote to memory of 4316 1848 23DF.tmp 89 PID 4316 wrote to memory of 1796 4316 2507.tmp 90 PID 1796 wrote to memory of 1092 1796 25E2.tmp 91 PID 1092 wrote to memory of 2408 1092 272A.tmp 92 PID 2408 wrote to memory of 4456 2408 2824.tmp 93 PID 4456 wrote to memory of 1836 4456 295D.tmp 94 PID 1836 wrote to memory of 2024 1836 2A57.tmp 95 PID 2024 wrote to memory of 2992 2024 2B32.tmp 96 PID 2992 wrote to memory of 1992 2992 2C3B.tmp 97 PID 1992 wrote to memory of 4076 1992 2D35.tmp 98 PID 4076 wrote to memory of 1540 4076 2E4E.tmp 99 PID 1540 wrote to memory of 3912 1540 2F58.tmp 100 PID 3912 wrote to memory of 4744 3912 3071.tmp 101 PID 4744 wrote to memory of 224 4744 316B.tmp 102 PID 224 wrote to memory of 2032 224 3265.tmp 103 PID 2032 wrote to memory of 3104 2032 3350.tmp 104 PID 3104 wrote to memory of 2708 3104 34B7.tmp 105 PID 2708 wrote to memory of 3624 2708 35B1.tmp 106 PID 3624 wrote to memory of 3000 3624 36AB.tmp 107 PID 3000 wrote to memory of 4580 3000 37A5.tmp 108 PID 4580 wrote to memory of 4440 4580 38BE.tmp 109 PID 4440 wrote to memory of 1448 4440 39E7.tmp 110 PID 1448 wrote to memory of 4972 1448 3AE1.tmp 111 PID 4972 wrote to memory of 4112 4972 3C0A.tmp 112 PID 4112 wrote to memory of 4368 4112 3CF4.tmp 113 PID 4368 wrote to memory of 776 4368 3E0E.tmp 114 PID 776 wrote to memory of 1536 776 3ED9.tmp 115 PID 1536 wrote to memory of 1680 1536 3FD3.tmp 116 PID 1680 wrote to memory of 4632 1680 40CD.tmp 117 PID 4632 wrote to memory of 4336 4632 41B7.tmp 118 PID 4336 wrote to memory of 1964 4336 4253.tmp 119 PID 1964 wrote to memory of 2920 1964 42E0.tmp 120 PID 2920 wrote to memory of 2952 2920 436D.tmp 121 PID 2952 wrote to memory of 5092 2952 43EA.tmp 122 PID 5092 wrote to memory of 3712 5092 4476.tmp 123 PID 3712 wrote to memory of 3224 3712 4503.tmp 124 PID 3224 wrote to memory of 2940 3224 459F.tmp 125 PID 2940 wrote to memory of 3992 2940 464B.tmp 126 PID 3992 wrote to memory of 2528 3992 46E7.tmp 128 PID 2528 wrote to memory of 2840 2528 4755.tmp 129 PID 2840 wrote to memory of 3328 2840 4801.tmp 130 PID 3328 wrote to memory of 2536 3328 489D.tmp 131 PID 2536 wrote to memory of 4760 2536 4939.tmp 132 PID 4760 wrote to memory of 4220 4760 4A04.tmp 133 PID 4220 wrote to memory of 3464 4220 4AA0.tmp 134 PID 3464 wrote to memory of 920 3464 4B0E.tmp 135 PID 920 wrote to memory of 1752 920 4B6C.tmp 136 PID 1752 wrote to memory of 3928 1752 4BD9.tmp 137 PID 3928 wrote to memory of 2260 3928 4C37.tmp 138 PID 2260 wrote to memory of 1028 2260 4C94.tmp 139 PID 1028 wrote to memory of 548 1028 4CE3.tmp 140 PID 548 wrote to memory of 1780 548 4D50.tmp 141 PID 1780 wrote to memory of 2124 1780 4D9E.tmp 142 PID 2124 wrote to memory of 4328 2124 4DEC.tmp 143 PID 4328 wrote to memory of 4904 4328 4E4A.tmp 144 PID 4904 wrote to memory of 4404 4904 4EB7.tmp 145 PID 4404 wrote to memory of 3068 4404 4F15.tmp 146 PID 3068 wrote to memory of 4296 3068 4F82.tmp 147 PID 4296 wrote to memory of 3444 4296 4FE0.tmp 148 PID 3444 wrote to memory of 1440 3444 503E.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_06344c2b86c07eb38fe0cf01acf8d200_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_06344c2b86c07eb38fe0cf01acf8d200_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\2006.tmp"C:\Users\Admin\AppData\Local\Temp\2006.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\212F.tmp"C:\Users\Admin\AppData\Local\Temp\212F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\2248.tmp"C:\Users\Admin\AppData\Local\Temp\2248.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\23DF.tmp"C:\Users\Admin\AppData\Local\Temp\23DF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\2507.tmp"C:\Users\Admin\AppData\Local\Temp\2507.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\25E2.tmp"C:\Users\Admin\AppData\Local\Temp\25E2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\272A.tmp"C:\Users\Admin\AppData\Local\Temp\272A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\2824.tmp"C:\Users\Admin\AppData\Local\Temp\2824.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\295D.tmp"C:\Users\Admin\AppData\Local\Temp\295D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\2A57.tmp"C:\Users\Admin\AppData\Local\Temp\2A57.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\2B32.tmp"C:\Users\Admin\AppData\Local\Temp\2B32.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\2D35.tmp"C:\Users\Admin\AppData\Local\Temp\2D35.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\2F58.tmp"C:\Users\Admin\AppData\Local\Temp\2F58.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\3071.tmp"C:\Users\Admin\AppData\Local\Temp\3071.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\316B.tmp"C:\Users\Admin\AppData\Local\Temp\316B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\3265.tmp"C:\Users\Admin\AppData\Local\Temp\3265.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\35B1.tmp"C:\Users\Admin\AppData\Local\Temp\35B1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\36AB.tmp"C:\Users\Admin\AppData\Local\Temp\36AB.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\37A5.tmp"C:\Users\Admin\AppData\Local\Temp\37A5.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\38BE.tmp"C:\Users\Admin\AppData\Local\Temp\38BE.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"C:\Users\Admin\AppData\Local\Temp\3CF4.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"C:\Users\Admin\AppData\Local\Temp\3ED9.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\40CD.tmp"C:\Users\Admin\AppData\Local\Temp\40CD.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\41B7.tmp"C:\Users\Admin\AppData\Local\Temp\41B7.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\4253.tmp"C:\Users\Admin\AppData\Local\Temp\4253.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\42E0.tmp"C:\Users\Admin\AppData\Local\Temp\42E0.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\436D.tmp"C:\Users\Admin\AppData\Local\Temp\436D.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\43EA.tmp"C:\Users\Admin\AppData\Local\Temp\43EA.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\4476.tmp"C:\Users\Admin\AppData\Local\Temp\4476.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\4503.tmp"C:\Users\Admin\AppData\Local\Temp\4503.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\459F.tmp"C:\Users\Admin\AppData\Local\Temp\459F.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\464B.tmp"C:\Users\Admin\AppData\Local\Temp\464B.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\46E7.tmp"C:\Users\Admin\AppData\Local\Temp\46E7.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\4755.tmp"C:\Users\Admin\AppData\Local\Temp\4755.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\4801.tmp"C:\Users\Admin\AppData\Local\Temp\4801.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\489D.tmp"C:\Users\Admin\AppData\Local\Temp\489D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\4939.tmp"C:\Users\Admin\AppData\Local\Temp\4939.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\4A04.tmp"C:\Users\Admin\AppData\Local\Temp\4A04.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\4C37.tmp"C:\Users\Admin\AppData\Local\Temp\4C37.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\4C94.tmp"C:\Users\Admin\AppData\Local\Temp\4C94.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\4D50.tmp"C:\Users\Admin\AppData\Local\Temp\4D50.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\4DEC.tmp"C:\Users\Admin\AppData\Local\Temp\4DEC.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\4EB7.tmp"C:\Users\Admin\AppData\Local\Temp\4EB7.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\4F15.tmp"C:\Users\Admin\AppData\Local\Temp\4F15.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\4F82.tmp"C:\Users\Admin\AppData\Local\Temp\4F82.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\503E.tmp"C:\Users\Admin\AppData\Local\Temp\503E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\50BB.tmp"C:\Users\Admin\AppData\Local\Temp\50BB.tmp"65⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\5119.tmp"C:\Users\Admin\AppData\Local\Temp\5119.tmp"66⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\5186.tmp"C:\Users\Admin\AppData\Local\Temp\5186.tmp"67⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\5222.tmp"C:\Users\Admin\AppData\Local\Temp\5222.tmp"68⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\5280.tmp"C:\Users\Admin\AppData\Local\Temp\5280.tmp"69⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\52DE.tmp"C:\Users\Admin\AppData\Local\Temp\52DE.tmp"70⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\534B.tmp"C:\Users\Admin\AppData\Local\Temp\534B.tmp"71⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\53A9.tmp"C:\Users\Admin\AppData\Local\Temp\53A9.tmp"72⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\53F7.tmp"C:\Users\Admin\AppData\Local\Temp\53F7.tmp"73⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\5445.tmp"C:\Users\Admin\AppData\Local\Temp\5445.tmp"74⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\54A3.tmp"C:\Users\Admin\AppData\Local\Temp\54A3.tmp"75⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\5530.tmp"C:\Users\Admin\AppData\Local\Temp\5530.tmp"76⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\558D.tmp"C:\Users\Admin\AppData\Local\Temp\558D.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\55DB.tmp"C:\Users\Admin\AppData\Local\Temp\55DB.tmp"78⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\5658.tmp"C:\Users\Admin\AppData\Local\Temp\5658.tmp"79⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\56A7.tmp"C:\Users\Admin\AppData\Local\Temp\56A7.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\5704.tmp"C:\Users\Admin\AppData\Local\Temp\5704.tmp"81⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\5791.tmp"C:\Users\Admin\AppData\Local\Temp\5791.tmp"82⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\57EF.tmp"C:\Users\Admin\AppData\Local\Temp\57EF.tmp"83⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\584C.tmp"C:\Users\Admin\AppData\Local\Temp\584C.tmp"84⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\58C9.tmp"C:\Users\Admin\AppData\Local\Temp\58C9.tmp"85⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"86⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\5975.tmp"C:\Users\Admin\AppData\Local\Temp\5975.tmp"87⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\59D3.tmp"C:\Users\Admin\AppData\Local\Temp\59D3.tmp"88⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"89⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"90⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"91⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\5B69.tmp"C:\Users\Admin\AppData\Local\Temp\5B69.tmp"92⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"93⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\5C06.tmp"C:\Users\Admin\AppData\Local\Temp\5C06.tmp"94⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\5C73.tmp"C:\Users\Admin\AppData\Local\Temp\5C73.tmp"95⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"96⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"97⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"C:\Users\Admin\AppData\Local\Temp\5DAB.tmp"98⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\5E19.tmp"C:\Users\Admin\AppData\Local\Temp\5E19.tmp"99⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\5E67.tmp"C:\Users\Admin\AppData\Local\Temp\5E67.tmp"100⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"101⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\5F32.tmp"C:\Users\Admin\AppData\Local\Temp\5F32.tmp"102⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\5F90.tmp"C:\Users\Admin\AppData\Local\Temp\5F90.tmp"103⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\600D.tmp"C:\Users\Admin\AppData\Local\Temp\600D.tmp"104⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\605B.tmp"C:\Users\Admin\AppData\Local\Temp\605B.tmp"105⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\60D8.tmp"C:\Users\Admin\AppData\Local\Temp\60D8.tmp"106⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\6136.tmp"C:\Users\Admin\AppData\Local\Temp\6136.tmp"107⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\61A3.tmp"C:\Users\Admin\AppData\Local\Temp\61A3.tmp"108⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\6230.tmp"C:\Users\Admin\AppData\Local\Temp\6230.tmp"109⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\62AD.tmp"C:\Users\Admin\AppData\Local\Temp\62AD.tmp"110⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\632A.tmp"C:\Users\Admin\AppData\Local\Temp\632A.tmp"111⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"112⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\6414.tmp"C:\Users\Admin\AppData\Local\Temp\6414.tmp"113⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\6462.tmp"C:\Users\Admin\AppData\Local\Temp\6462.tmp"114⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\64C0.tmp"C:\Users\Admin\AppData\Local\Temp\64C0.tmp"115⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\651E.tmp"C:\Users\Admin\AppData\Local\Temp\651E.tmp"116⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\657B.tmp"C:\Users\Admin\AppData\Local\Temp\657B.tmp"117⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\65CA.tmp"C:\Users\Admin\AppData\Local\Temp\65CA.tmp"118⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\6627.tmp"C:\Users\Admin\AppData\Local\Temp\6627.tmp"119⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\6695.tmp"C:\Users\Admin\AppData\Local\Temp\6695.tmp"120⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\6702.tmp"C:\Users\Admin\AppData\Local\Temp\6702.tmp"121⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\6750.tmp"C:\Users\Admin\AppData\Local\Temp\6750.tmp"122⤵PID:2164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-