Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 19:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_8f6c9855c14b4485d258d75ca1487130_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_8f6c9855c14b4485d258d75ca1487130_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-09_8f6c9855c14b4485d258d75ca1487130_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260809-yeyqfacb59
- SHA256 a3c0ac54e5ad72567778aacec7af62fa0d3e0556f8fba9e62f2ffe627a9772bb
- MD5 8f6c9855c14b4485d258d75ca1487130
- SHA1 f5697f5b02aca2f364a7f400e68759eac0722ad5
- SHA512 678576034afae2d0675bbeed090b55ca21c8f07475621cd913efb03a07df866a400bb191ce3b35ea63a1ced557cc5e5c64d4fc76cdf8657870284d384403d0a8
- SSDEEP 6144:oorf3lPvovsgZnqG2C7mOTeiL/DLnbdH/GO4pgwq5Qpcb7v4tYM5AmfCua7DcUqF:NU5rCOTeijrdIq5QGbCYvaCc0TZwlH
- TLSH T19BB4F126B285C132E6C211354FE6EBB22A3A7C35572294C72BD4663E2FB52D1D37530B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1720 B1F6.tmp 4048 B2A1.tmp 60 B34D.tmp 3300 B447.tmp 4636 B4E4.tmp 5068 B570.tmp 4348 B5FD.tmp 5052 B6A9.tmp 4608 B716.tmp 3792 B7F1.tmp 4572 B88D.tmp 988 B929.tmp 3568 B9B6.tmp 2432 BA43.tmp 916 BACF.tmp 2976 BB6B.tmp 312 BC17.tmp 216 BCA4.tmp 3172 BD21.tmp 3324 BD9E.tmp 4900 BE1B.tmp 4776 BEC7.tmp 4876 BF82.tmp 2892 C03E.tmp 3216 C0EA.tmp 4512 C167.tmp 2348 C232.tmp 4036 C2ED.tmp 1804 C38A.tmp 3056 C445.tmp 3508 C501.tmp 2376 C56E.tmp 568 C5EB.tmp 4704 C639.tmp 4964 C687.tmp 5048 C704.tmp 4708 C781.tmp 3464 C7CF.tmp 4028 C82D.tmp 4020 C87B.tmp 4056 C8D9.tmp 4728 C946.tmp 1156 C9B4.tmp 4884 CA02.tmp 2136 CA50.tmp 3744 CA9E.tmp 4940 CAFC.tmp 3268 CB69.tmp 4324 CBB7.tmp 4232 CC05.tmp 820 CC73.tmp 2424 CCC1.tmp 1412 CD0F.tmp 1664 CD5D.tmp 4996 CDAB.tmp 3304 CE19.tmp 4596 CE96.tmp 560 CF03.tmp 536 CF51.tmp 1904 CFCE.tmp 2628 D01C.tmp 2076 D06A.tmp 3248 D0B9.tmp 2836 D107.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D807.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D01C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F076.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F17F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 528B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 838E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A222.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 646D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D19E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4651.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D651.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 939B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E654.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F642.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DDA.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2272 wrote to memory of 1720 2272 2026-08-09_8f6c9855c14b4485d258d75ca1487130_elex_mafia_stealc_tofsee.exe 84 PID 1720 wrote to memory of 4048 1720 B1F6.tmp 85 PID 4048 wrote to memory of 60 4048 B2A1.tmp 86 PID 60 wrote to memory of 3300 60 B34D.tmp 87 PID 3300 wrote to memory of 4636 3300 B447.tmp 88 PID 4636 wrote to memory of 5068 4636 B4E4.tmp 89 PID 5068 wrote to memory of 4348 5068 B570.tmp 90 PID 4348 wrote to memory of 5052 4348 B5FD.tmp 91 PID 5052 wrote to memory of 4608 5052 B6A9.tmp 92 PID 4608 wrote to memory of 3792 4608 B716.tmp 93 PID 3792 wrote to memory of 4572 3792 B7F1.tmp 94 PID 4572 wrote to memory of 988 4572 B88D.tmp 95 PID 988 wrote to memory of 3568 988 B929.tmp 96 PID 3568 wrote to memory of 2432 3568 B9B6.tmp 97 PID 2432 wrote to memory of 916 2432 BA43.tmp 98 PID 916 wrote to memory of 2976 916 BACF.tmp 99 PID 2976 wrote to memory of 312 2976 BB6B.tmp 100 PID 312 wrote to memory of 216 312 BC17.tmp 101 PID 216 wrote to memory of 3172 216 BCA4.tmp 102 PID 3172 wrote to memory of 3324 3172 BD21.tmp 103 PID 3324 wrote to memory of 4900 3324 BD9E.tmp 104 PID 4900 wrote to memory of 4776 4900 BE1B.tmp 105 PID 4776 wrote to memory of 4876 4776 BEC7.tmp 106 PID 4876 wrote to memory of 2892 4876 BF82.tmp 107 PID 2892 wrote to memory of 3216 2892 C03E.tmp 108 PID 3216 wrote to memory of 4512 3216 C0EA.tmp 109 PID 4512 wrote to memory of 2348 4512 C167.tmp 110 PID 2348 wrote to memory of 4036 2348 C232.tmp 111 PID 4036 wrote to memory of 1804 4036 C2ED.tmp 112 PID 1804 wrote to memory of 3056 1804 C38A.tmp 113 PID 3056 wrote to memory of 3508 3056 C445.tmp 114 PID 3508 wrote to memory of 2376 3508 C501.tmp 115 PID 2376 wrote to memory of 568 2376 C56E.tmp 116 PID 568 wrote to memory of 4704 568 C5EB.tmp 117 PID 4704 wrote to memory of 4964 4704 C639.tmp 118 PID 4964 wrote to memory of 5048 4964 C687.tmp 119 PID 5048 wrote to memory of 4708 5048 C704.tmp 120 PID 4708 wrote to memory of 3464 4708 C781.tmp 121 PID 3464 wrote to memory of 4028 3464 C7CF.tmp 122 PID 4028 wrote to memory of 4020 4028 C82D.tmp 123 PID 4020 wrote to memory of 4056 4020 C87B.tmp 124 PID 4056 wrote to memory of 4728 4056 C8D9.tmp 125 PID 4728 wrote to memory of 1156 4728 C946.tmp 126 PID 1156 wrote to memory of 4884 1156 C9B4.tmp 127 PID 4884 wrote to memory of 2136 4884 CA02.tmp 128 PID 2136 wrote to memory of 3744 2136 CA50.tmp 129 PID 3744 wrote to memory of 4940 3744 CA9E.tmp 130 PID 4940 wrote to memory of 3268 4940 CAFC.tmp 131 PID 3268 wrote to memory of 4324 3268 CB69.tmp 132 PID 4324 wrote to memory of 4232 4324 CBB7.tmp 133 PID 4232 wrote to memory of 820 4232 CC05.tmp 134 PID 820 wrote to memory of 2424 820 CC73.tmp 135 PID 2424 wrote to memory of 1412 2424 CCC1.tmp 136 PID 1412 wrote to memory of 1664 1412 CD0F.tmp 137 PID 1664 wrote to memory of 4996 1664 CD5D.tmp 138 PID 4996 wrote to memory of 3304 4996 CDAB.tmp 139 PID 3304 wrote to memory of 4596 3304 CE19.tmp 140 PID 4596 wrote to memory of 560 4596 CE96.tmp 141 PID 560 wrote to memory of 536 560 CF03.tmp 142 PID 536 wrote to memory of 1904 536 CF51.tmp 143 PID 1904 wrote to memory of 2628 1904 CFCE.tmp 144 PID 2628 wrote to memory of 2076 2628 D01C.tmp 145 PID 2076 wrote to memory of 3248 2076 D06A.tmp 146 PID 3248 wrote to memory of 2836 3248 D0B9.tmp 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_8f6c9855c14b4485d258d75ca1487130_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_8f6c9855c14b4485d258d75ca1487130_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\B1F6.tmp"C:\Users\Admin\AppData\Local\Temp\B1F6.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\B2A1.tmp"C:\Users\Admin\AppData\Local\Temp\B2A1.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\B34D.tmp"C:\Users\Admin\AppData\Local\Temp\B34D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\B447.tmp"C:\Users\Admin\AppData\Local\Temp\B447.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\B4E4.tmp"C:\Users\Admin\AppData\Local\Temp\B4E4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\B570.tmp"C:\Users\Admin\AppData\Local\Temp\B570.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\B5FD.tmp"C:\Users\Admin\AppData\Local\Temp\B5FD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\B6A9.tmp"C:\Users\Admin\AppData\Local\Temp\B6A9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\B716.tmp"C:\Users\Admin\AppData\Local\Temp\B716.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\B7F1.tmp"C:\Users\Admin\AppData\Local\Temp\B7F1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\B88D.tmp"C:\Users\Admin\AppData\Local\Temp\B88D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\B929.tmp"C:\Users\Admin\AppData\Local\Temp\B929.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\B9B6.tmp"C:\Users\Admin\AppData\Local\Temp\B9B6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\BA43.tmp"C:\Users\Admin\AppData\Local\Temp\BA43.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\BACF.tmp"C:\Users\Admin\AppData\Local\Temp\BACF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\BB6B.tmp"C:\Users\Admin\AppData\Local\Temp\BB6B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\BC17.tmp"C:\Users\Admin\AppData\Local\Temp\BC17.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\BCA4.tmp"C:\Users\Admin\AppData\Local\Temp\BCA4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\BD21.tmp"C:\Users\Admin\AppData\Local\Temp\BD21.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\BD9E.tmp"C:\Users\Admin\AppData\Local\Temp\BD9E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\BE1B.tmp"C:\Users\Admin\AppData\Local\Temp\BE1B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\BEC7.tmp"C:\Users\Admin\AppData\Local\Temp\BEC7.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\BF82.tmp"C:\Users\Admin\AppData\Local\Temp\BF82.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\C03E.tmp"C:\Users\Admin\AppData\Local\Temp\C03E.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\C0EA.tmp"C:\Users\Admin\AppData\Local\Temp\C0EA.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\C167.tmp"C:\Users\Admin\AppData\Local\Temp\C167.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\C232.tmp"C:\Users\Admin\AppData\Local\Temp\C232.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\C2ED.tmp"C:\Users\Admin\AppData\Local\Temp\C2ED.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\C38A.tmp"C:\Users\Admin\AppData\Local\Temp\C38A.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\C445.tmp"C:\Users\Admin\AppData\Local\Temp\C445.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\C501.tmp"C:\Users\Admin\AppData\Local\Temp\C501.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\C56E.tmp"C:\Users\Admin\AppData\Local\Temp\C56E.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\C5EB.tmp"C:\Users\Admin\AppData\Local\Temp\C5EB.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\C639.tmp"C:\Users\Admin\AppData\Local\Temp\C639.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\C687.tmp"C:\Users\Admin\AppData\Local\Temp\C687.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\C704.tmp"C:\Users\Admin\AppData\Local\Temp\C704.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\C781.tmp"C:\Users\Admin\AppData\Local\Temp\C781.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\C7CF.tmp"C:\Users\Admin\AppData\Local\Temp\C7CF.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\C82D.tmp"C:\Users\Admin\AppData\Local\Temp\C82D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\C87B.tmp"C:\Users\Admin\AppData\Local\Temp\C87B.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\C8D9.tmp"C:\Users\Admin\AppData\Local\Temp\C8D9.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\C946.tmp"C:\Users\Admin\AppData\Local\Temp\C946.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"C:\Users\Admin\AppData\Local\Temp\C9B4.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\CA02.tmp"C:\Users\Admin\AppData\Local\Temp\CA02.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\CA50.tmp"C:\Users\Admin\AppData\Local\Temp\CA50.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\CA9E.tmp"C:\Users\Admin\AppData\Local\Temp\CA9E.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\CAFC.tmp"C:\Users\Admin\AppData\Local\Temp\CAFC.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\CB69.tmp"C:\Users\Admin\AppData\Local\Temp\CB69.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\CBB7.tmp"C:\Users\Admin\AppData\Local\Temp\CBB7.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\CC05.tmp"C:\Users\Admin\AppData\Local\Temp\CC05.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\CE19.tmp"C:\Users\Admin\AppData\Local\Temp\CE19.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\CE96.tmp"C:\Users\Admin\AppData\Local\Temp\CE96.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\CF03.tmp"C:\Users\Admin\AppData\Local\Temp\CF03.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\CF51.tmp"C:\Users\Admin\AppData\Local\Temp\CF51.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\CFCE.tmp"C:\Users\Admin\AppData\Local\Temp\CFCE.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\D01C.tmp"C:\Users\Admin\AppData\Local\Temp\D01C.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\D06A.tmp"C:\Users\Admin\AppData\Local\Temp\D06A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\D0B9.tmp"C:\Users\Admin\AppData\Local\Temp\D0B9.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\D107.tmp"C:\Users\Admin\AppData\Local\Temp\D107.tmp"65⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\D164.tmp"C:\Users\Admin\AppData\Local\Temp\D164.tmp"66⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\D1C2.tmp"C:\Users\Admin\AppData\Local\Temp\D1C2.tmp"67⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\D23F.tmp"C:\Users\Admin\AppData\Local\Temp\D23F.tmp"68⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\D2AD.tmp"C:\Users\Admin\AppData\Local\Temp\D2AD.tmp"69⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\D339.tmp"C:\Users\Admin\AppData\Local\Temp\D339.tmp"70⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\D387.tmp"C:\Users\Admin\AppData\Local\Temp\D387.tmp"71⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"72⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\D424.tmp"C:\Users\Admin\AppData\Local\Temp\D424.tmp"73⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\D472.tmp"C:\Users\Admin\AppData\Local\Temp\D472.tmp"74⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\D4DF.tmp"C:\Users\Admin\AppData\Local\Temp\D4DF.tmp"75⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\D54C.tmp"C:\Users\Admin\AppData\Local\Temp\D54C.tmp"76⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\D5BA.tmp"C:\Users\Admin\AppData\Local\Temp\D5BA.tmp"77⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\D637.tmp"C:\Users\Admin\AppData\Local\Temp\D637.tmp"78⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\D685.tmp"C:\Users\Admin\AppData\Local\Temp\D685.tmp"79⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"80⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\D731.tmp"C:\Users\Admin\AppData\Local\Temp\D731.tmp"81⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\D77F.tmp"C:\Users\Admin\AppData\Local\Temp\D77F.tmp"82⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"83⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\D85A.tmp"C:\Users\Admin\AppData\Local\Temp\D85A.tmp"84⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\D8B7.tmp"C:\Users\Admin\AppData\Local\Temp\D8B7.tmp"85⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\D915.tmp"C:\Users\Admin\AppData\Local\Temp\D915.tmp"86⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\D973.tmp"C:\Users\Admin\AppData\Local\Temp\D973.tmp"87⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\D9D1.tmp"C:\Users\Admin\AppData\Local\Temp\D9D1.tmp"88⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\DA1F.tmp"C:\Users\Admin\AppData\Local\Temp\DA1F.tmp"89⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\DA9C.tmp"C:\Users\Admin\AppData\Local\Temp\DA9C.tmp"90⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\DAFA.tmp"C:\Users\Admin\AppData\Local\Temp\DAFA.tmp"91⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\DB48.tmp"C:\Users\Admin\AppData\Local\Temp\DB48.tmp"92⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\DBA5.tmp"C:\Users\Admin\AppData\Local\Temp\DBA5.tmp"93⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\DC03.tmp"C:\Users\Admin\AppData\Local\Temp\DC03.tmp"94⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\DC80.tmp"C:\Users\Admin\AppData\Local\Temp\DC80.tmp"95⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\DCDE.tmp"C:\Users\Admin\AppData\Local\Temp\DCDE.tmp"96⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\DD3C.tmp"C:\Users\Admin\AppData\Local\Temp\DD3C.tmp"97⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\DD99.tmp"C:\Users\Admin\AppData\Local\Temp\DD99.tmp"98⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\DDE8.tmp"C:\Users\Admin\AppData\Local\Temp\DDE8.tmp"99⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\DE55.tmp"C:\Users\Admin\AppData\Local\Temp\DE55.tmp"100⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\DEA3.tmp"C:\Users\Admin\AppData\Local\Temp\DEA3.tmp"101⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\DEF1.tmp"C:\Users\Admin\AppData\Local\Temp\DEF1.tmp"102⤵
- System Location Discovery: System Language Discovery
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\DF3F.tmp"C:\Users\Admin\AppData\Local\Temp\DF3F.tmp"103⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\DFAD.tmp"C:\Users\Admin\AppData\Local\Temp\DFAD.tmp"104⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\DFFB.tmp"C:\Users\Admin\AppData\Local\Temp\DFFB.tmp"105⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\E049.tmp"C:\Users\Admin\AppData\Local\Temp\E049.tmp"106⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\E0C6.tmp"C:\Users\Admin\AppData\Local\Temp\E0C6.tmp"107⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\E143.tmp"C:\Users\Admin\AppData\Local\Temp\E143.tmp"108⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\E191.tmp"C:\Users\Admin\AppData\Local\Temp\E191.tmp"109⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\E1EF.tmp"C:\Users\Admin\AppData\Local\Temp\E1EF.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\E24D.tmp"C:\Users\Admin\AppData\Local\Temp\E24D.tmp"111⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\E2CA.tmp"C:\Users\Admin\AppData\Local\Temp\E2CA.tmp"112⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\E327.tmp"C:\Users\Admin\AppData\Local\Temp\E327.tmp"113⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\E375.tmp"C:\Users\Admin\AppData\Local\Temp\E375.tmp"114⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\E3C4.tmp"C:\Users\Admin\AppData\Local\Temp\E3C4.tmp"115⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\E431.tmp"C:\Users\Admin\AppData\Local\Temp\E431.tmp"116⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\E47F.tmp"C:\Users\Admin\AppData\Local\Temp\E47F.tmp"117⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\E4CD.tmp"C:\Users\Admin\AppData\Local\Temp\E4CD.tmp"118⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\E52B.tmp"C:\Users\Admin\AppData\Local\Temp\E52B.tmp"119⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\E5A8.tmp"C:\Users\Admin\AppData\Local\Temp\E5A8.tmp"120⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\E606.tmp"C:\Users\Admin\AppData\Local\Temp\E606.tmp"121⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\E654.tmp"C:\Users\Admin\AppData\Local\Temp\E654.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:4016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-