Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 07:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_2d686050b3a6ac841d1007d1941a1b41_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_2d686050b3a6ac841d1007d1941a1b41_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-04_2d686050b3a6ac841d1007d1941a1b41_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample260804-jrbdcaff52
- SHA256 6727d1ea1e0a7b1890661f8af63f3d9e36c6b33d01b47a9ff3ac203ac4d7d0ea
- MD5 2d686050b3a6ac841d1007d1941a1b41
- SHA1 3e88e7d1734b7ecdf11b5367d264c31ad7f2cca2
- SHA512 d68a97c41272e51926ab8bb030e5b330d65159dbff016dffc4ef0c79ec1e70cb3124ebf0a71efe2b880af5891ca71a5453943d6e78fc865e52850f160eddff5c
- SSDEEP 12288:9U5rCOTei6gLccpoUJD/l7lEY4aqgch/iqZoXWjdqpby1grA70G+o:9UQOJ6tcpVDhS0QhaqqGh4yATXo
- TLSH T1F6E401247A85C436E99712304FE2E7B2597BBC31572264C73B84A76E6F712E0A379307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 848 467A.tmp 4564 4745.tmp 1048 4793.tmp 2268 47E1.tmp 2124 482F.tmp 4732 488D.tmp 2472 48DB.tmp 2516 4929.tmp 4408 4978.tmp 3400 49C6.tmp 4196 4A14.tmp 2976 4A62.tmp 4520 4AB0.tmp 1968 4AFE.tmp 1044 4B4C.tmp 3900 4FFF.tmp 3784 505D.tmp 2596 50AB.tmp 3780 5109.tmp 4084 5167.tmp 1892 51B5.tmp 760 5203.tmp 4392 5251.tmp 5060 52AF.tmp 4160 530D.tmp 1616 536A.tmp 724 53C8.tmp 204 5416.tmp 3236 5464.tmp 3012 54B3.tmp 2648 5510.tmp 4264 556E.tmp 3776 55BC.tmp 1844 560A.tmp 3720 5658.tmp 4336 56A7.tmp 4396 56F5.tmp 2960 5752.tmp 1696 57A1.tmp 312 57EF.tmp 4980 583D.tmp 2868 588B.tmp 4992 58D9.tmp 4484 5927.tmp 1356 5975.tmp 1080 59C3.tmp 3256 5A12.tmp 3540 5A60.tmp 972 5AAE.tmp 4480 5AFC.tmp 4928 5B4A.tmp 540 5B98.tmp 4712 5BE6.tmp 1508 5C34.tmp 1444 5C83.tmp 3288 5CD1.tmp 4216 5D1F.tmp 2024 5D6D.tmp 1524 5DBB.tmp 1760 5E09.tmp 4916 5E57.tmp 1832 5EA5.tmp 2008 5EF4.tmp 4012 5F42.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8095.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6680.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8795.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 818A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 289D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7819.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 677F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 771A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B377.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B188.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A033.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2735.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9054.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 303E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4637.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F586.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8236.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8497.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A771.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E78C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 909E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4896 wrote to memory of 848 4896 2026-08-04_2d686050b3a6ac841d1007d1941a1b41_elex_mafia_stealc_tofsee.exe 86 PID 848 wrote to memory of 4564 848 467A.tmp 87 PID 4564 wrote to memory of 1048 4564 4745.tmp 88 PID 1048 wrote to memory of 2268 1048 4793.tmp 89 PID 2268 wrote to memory of 2124 2268 47E1.tmp 90 PID 2124 wrote to memory of 4732 2124 482F.tmp 91 PID 4732 wrote to memory of 2472 4732 488D.tmp 92 PID 2472 wrote to memory of 2516 2472 48DB.tmp 93 PID 2516 wrote to memory of 4408 2516 4929.tmp 94 PID 4408 wrote to memory of 3400 4408 4978.tmp 95 PID 3400 wrote to memory of 4196 3400 49C6.tmp 96 PID 4196 wrote to memory of 2976 4196 4A14.tmp 97 PID 2976 wrote to memory of 4520 2976 4A62.tmp 98 PID 4520 wrote to memory of 1968 4520 4AB0.tmp 99 PID 1968 wrote to memory of 1044 1968 4AFE.tmp 100 PID 1044 wrote to memory of 3900 1044 4B4C.tmp 101 PID 3900 wrote to memory of 3784 3900 4FFF.tmp 102 PID 3784 wrote to memory of 2596 3784 505D.tmp 103 PID 2596 wrote to memory of 3780 2596 50AB.tmp 104 PID 3780 wrote to memory of 4084 3780 5109.tmp 105 PID 4084 wrote to memory of 1892 4084 5167.tmp 106 PID 1892 wrote to memory of 760 1892 51B5.tmp 107 PID 760 wrote to memory of 4392 760 5203.tmp 108 PID 4392 wrote to memory of 5060 4392 5251.tmp 109 PID 5060 wrote to memory of 4160 5060 52AF.tmp 110 PID 4160 wrote to memory of 1616 4160 530D.tmp 111 PID 1616 wrote to memory of 724 1616 536A.tmp 112 PID 724 wrote to memory of 204 724 53C8.tmp 113 PID 204 wrote to memory of 3236 204 5416.tmp 114 PID 3236 wrote to memory of 3012 3236 5464.tmp 115 PID 3012 wrote to memory of 2648 3012 54B3.tmp 116 PID 2648 wrote to memory of 4264 2648 5510.tmp 118 PID 4264 wrote to memory of 3776 4264 556E.tmp 119 PID 3776 wrote to memory of 1844 3776 55BC.tmp 120 PID 1844 wrote to memory of 3720 1844 560A.tmp 121 PID 3720 wrote to memory of 4336 3720 5658.tmp 122 PID 4336 wrote to memory of 4396 4336 56A7.tmp 123 PID 4396 wrote to memory of 2960 4396 56F5.tmp 124 PID 2960 wrote to memory of 1696 2960 5752.tmp 125 PID 1696 wrote to memory of 312 1696 57A1.tmp 126 PID 312 wrote to memory of 4980 312 57EF.tmp 127 PID 4980 wrote to memory of 2868 4980 583D.tmp 128 PID 2868 wrote to memory of 4992 2868 588B.tmp 129 PID 4992 wrote to memory of 4484 4992 58D9.tmp 130 PID 4484 wrote to memory of 1356 4484 5927.tmp 131 PID 1356 wrote to memory of 1080 1356 5975.tmp 132 PID 1080 wrote to memory of 3256 1080 59C3.tmp 133 PID 3256 wrote to memory of 3540 3256 5A12.tmp 134 PID 3540 wrote to memory of 972 3540 5A60.tmp 135 PID 972 wrote to memory of 4480 972 5AAE.tmp 136 PID 4480 wrote to memory of 4928 4480 5AFC.tmp 137 PID 4928 wrote to memory of 540 4928 5B4A.tmp 138 PID 540 wrote to memory of 4712 540 5B98.tmp 139 PID 4712 wrote to memory of 1508 4712 5BE6.tmp 140 PID 1508 wrote to memory of 1444 1508 5C34.tmp 141 PID 1444 wrote to memory of 3288 1444 5C83.tmp 142 PID 3288 wrote to memory of 4216 3288 5CD1.tmp 143 PID 4216 wrote to memory of 2024 4216 5D1F.tmp 144 PID 2024 wrote to memory of 1524 2024 5D6D.tmp 145 PID 1524 wrote to memory of 1760 1524 5DBB.tmp 146 PID 1760 wrote to memory of 4916 1760 5E09.tmp 147 PID 4916 wrote to memory of 1832 4916 5E57.tmp 148 PID 1832 wrote to memory of 2008 1832 5EA5.tmp 149 PID 2008 wrote to memory of 4012 2008 5EF4.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_2d686050b3a6ac841d1007d1941a1b41_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_2d686050b3a6ac841d1007d1941a1b41_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\467A.tmp"C:\Users\Admin\AppData\Local\Temp\467A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\4745.tmp"C:\Users\Admin\AppData\Local\Temp\4745.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\47E1.tmp"C:\Users\Admin\AppData\Local\Temp\47E1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\482F.tmp"C:\Users\Admin\AppData\Local\Temp\482F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\488D.tmp"C:\Users\Admin\AppData\Local\Temp\488D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\48DB.tmp"C:\Users\Admin\AppData\Local\Temp\48DB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\4929.tmp"C:\Users\Admin\AppData\Local\Temp\4929.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\4978.tmp"C:\Users\Admin\AppData\Local\Temp\4978.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\49C6.tmp"C:\Users\Admin\AppData\Local\Temp\49C6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\4A14.tmp"C:\Users\Admin\AppData\Local\Temp\4A14.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\4A62.tmp"C:\Users\Admin\AppData\Local\Temp\4A62.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\4AFE.tmp"C:\Users\Admin\AppData\Local\Temp\4AFE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\505D.tmp"C:\Users\Admin\AppData\Local\Temp\505D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\50AB.tmp"C:\Users\Admin\AppData\Local\Temp\50AB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\5109.tmp"C:\Users\Admin\AppData\Local\Temp\5109.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\5167.tmp"C:\Users\Admin\AppData\Local\Temp\5167.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\51B5.tmp"C:\Users\Admin\AppData\Local\Temp\51B5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\5203.tmp"C:\Users\Admin\AppData\Local\Temp\5203.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\5251.tmp"C:\Users\Admin\AppData\Local\Temp\5251.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\52AF.tmp"C:\Users\Admin\AppData\Local\Temp\52AF.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\530D.tmp"C:\Users\Admin\AppData\Local\Temp\530D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\536A.tmp"C:\Users\Admin\AppData\Local\Temp\536A.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\53C8.tmp"C:\Users\Admin\AppData\Local\Temp\53C8.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\5416.tmp"C:\Users\Admin\AppData\Local\Temp\5416.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\5464.tmp"C:\Users\Admin\AppData\Local\Temp\5464.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\54B3.tmp"C:\Users\Admin\AppData\Local\Temp\54B3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\5510.tmp"C:\Users\Admin\AppData\Local\Temp\5510.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\556E.tmp"C:\Users\Admin\AppData\Local\Temp\556E.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\55BC.tmp"C:\Users\Admin\AppData\Local\Temp\55BC.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\560A.tmp"C:\Users\Admin\AppData\Local\Temp\560A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\5658.tmp"C:\Users\Admin\AppData\Local\Temp\5658.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\56A7.tmp"C:\Users\Admin\AppData\Local\Temp\56A7.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\56F5.tmp"C:\Users\Admin\AppData\Local\Temp\56F5.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\5752.tmp"C:\Users\Admin\AppData\Local\Temp\5752.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\57A1.tmp"C:\Users\Admin\AppData\Local\Temp\57A1.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\57EF.tmp"C:\Users\Admin\AppData\Local\Temp\57EF.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\583D.tmp"C:\Users\Admin\AppData\Local\Temp\583D.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\588B.tmp"C:\Users\Admin\AppData\Local\Temp\588B.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\58D9.tmp"C:\Users\Admin\AppData\Local\Temp\58D9.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\5927.tmp"C:\Users\Admin\AppData\Local\Temp\5927.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\5975.tmp"C:\Users\Admin\AppData\Local\Temp\5975.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\59C3.tmp"C:\Users\Admin\AppData\Local\Temp\59C3.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\5A12.tmp"C:\Users\Admin\AppData\Local\Temp\5A12.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\5A60.tmp"C:\Users\Admin\AppData\Local\Temp\5A60.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\5C34.tmp"C:\Users\Admin\AppData\Local\Temp\5C34.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\5C83.tmp"C:\Users\Admin\AppData\Local\Temp\5C83.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\5DBB.tmp"C:\Users\Admin\AppData\Local\Temp\5DBB.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\5E09.tmp"C:\Users\Admin\AppData\Local\Temp\5E09.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\5E57.tmp"C:\Users\Admin\AppData\Local\Temp\5E57.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\5EF4.tmp"C:\Users\Admin\AppData\Local\Temp\5EF4.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\5F42.tmp"C:\Users\Admin\AppData\Local\Temp\5F42.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\5F90.tmp"C:\Users\Admin\AppData\Local\Temp\5F90.tmp"66⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"67⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"68⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\607A.tmp"C:\Users\Admin\AppData\Local\Temp\607A.tmp"69⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\60C8.tmp"C:\Users\Admin\AppData\Local\Temp\60C8.tmp"70⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\6116.tmp"C:\Users\Admin\AppData\Local\Temp\6116.tmp"71⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\6165.tmp"C:\Users\Admin\AppData\Local\Temp\6165.tmp"72⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\61B3.tmp"C:\Users\Admin\AppData\Local\Temp\61B3.tmp"73⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\6201.tmp"C:\Users\Admin\AppData\Local\Temp\6201.tmp"74⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\624F.tmp"C:\Users\Admin\AppData\Local\Temp\624F.tmp"75⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\629D.tmp"C:\Users\Admin\AppData\Local\Temp\629D.tmp"76⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\62EB.tmp"C:\Users\Admin\AppData\Local\Temp\62EB.tmp"77⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\6339.tmp"C:\Users\Admin\AppData\Local\Temp\6339.tmp"78⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"79⤵PID:524
-
C:\Users\Admin\AppData\Local\Temp\63D6.tmp"C:\Users\Admin\AppData\Local\Temp\63D6.tmp"80⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\6424.tmp"C:\Users\Admin\AppData\Local\Temp\6424.tmp"81⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\6472.tmp"C:\Users\Admin\AppData\Local\Temp\6472.tmp"82⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\64C0.tmp"C:\Users\Admin\AppData\Local\Temp\64C0.tmp"83⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\650E.tmp"C:\Users\Admin\AppData\Local\Temp\650E.tmp"84⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\655C.tmp"C:\Users\Admin\AppData\Local\Temp\655C.tmp"85⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\65AA.tmp"C:\Users\Admin\AppData\Local\Temp\65AA.tmp"86⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\65F8.tmp"C:\Users\Admin\AppData\Local\Temp\65F8.tmp"87⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\6647.tmp"C:\Users\Admin\AppData\Local\Temp\6647.tmp"88⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\6695.tmp"C:\Users\Admin\AppData\Local\Temp\6695.tmp"89⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\66E3.tmp"C:\Users\Admin\AppData\Local\Temp\66E3.tmp"90⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\6731.tmp"C:\Users\Admin\AppData\Local\Temp\6731.tmp"91⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\677F.tmp"C:\Users\Admin\AppData\Local\Temp\677F.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\67CD.tmp"C:\Users\Admin\AppData\Local\Temp\67CD.tmp"93⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\681B.tmp"C:\Users\Admin\AppData\Local\Temp\681B.tmp"94⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\6869.tmp"C:\Users\Admin\AppData\Local\Temp\6869.tmp"95⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\68C7.tmp"C:\Users\Admin\AppData\Local\Temp\68C7.tmp"96⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\6915.tmp"C:\Users\Admin\AppData\Local\Temp\6915.tmp"97⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\6963.tmp"C:\Users\Admin\AppData\Local\Temp\6963.tmp"98⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\69B2.tmp"C:\Users\Admin\AppData\Local\Temp\69B2.tmp"99⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\6A00.tmp"C:\Users\Admin\AppData\Local\Temp\6A00.tmp"100⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\6A4E.tmp"C:\Users\Admin\AppData\Local\Temp\6A4E.tmp"101⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\6A9C.tmp"C:\Users\Admin\AppData\Local\Temp\6A9C.tmp"102⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"103⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\6B38.tmp"C:\Users\Admin\AppData\Local\Temp\6B38.tmp"104⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\6B86.tmp"C:\Users\Admin\AppData\Local\Temp\6B86.tmp"105⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"106⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\6C23.tmp"C:\Users\Admin\AppData\Local\Temp\6C23.tmp"107⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\6C71.tmp"C:\Users\Admin\AppData\Local\Temp\6C71.tmp"108⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"109⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"110⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"111⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"112⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"113⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\6E45.tmp"C:\Users\Admin\AppData\Local\Temp\6E45.tmp"114⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\6E94.tmp"C:\Users\Admin\AppData\Local\Temp\6E94.tmp"115⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"116⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\6F30.tmp"C:\Users\Admin\AppData\Local\Temp\6F30.tmp"117⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"118⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"119⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\701A.tmp"C:\Users\Admin\AppData\Local\Temp\701A.tmp"120⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\7068.tmp"C:\Users\Admin\AppData\Local\Temp\7068.tmp"121⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\70B6.tmp"C:\Users\Admin\AppData\Local\Temp\70B6.tmp"122⤵PID:4600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-