Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/08/2026, 00:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_0c89e80a316fc35732c653dfe0a695a4_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_0c89e80a316fc35732c653dfe0a695a4_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-14_0c89e80a316fc35732c653dfe0a695a4_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260815-apylesck31
- SHA256 6eeb05e4ad412843db373662399c943703964c0fb8a120485e978eec122a9110
- MD5 0c89e80a316fc35732c653dfe0a695a4
- SHA1 0e3424300255cca57bf24de261db9dfca6912946
- SHA512 da8777539f786f236f33d16b69263131bc3c92fe158ac44b22c5d75a9d357964d3db30f46ba90f624289b5103e785dbe5203e36e4cca38452ee21d9ed10f4ee4
- SSDEEP 12288:NU5rCOTeijupbXbs5u7qJA5PgEYjBk1kPc8TZwlH4Hp:NUQOJjQXbr7qS5P7YVk1cTSlH4Hp
- TLSH T148B4F126B684C132E6C202710AD6EBF2693B7D355766A4C33B90623E2FB17D1D379346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3796 38CE.tmp 3472 397A.tmp 976 3A45.tmp 3044 3B2F.tmp 4580 3BCC.tmp 4868 3C68.tmp 2612 3D33.tmp 3060 3DCF.tmp 2552 3EAA.tmp 2152 3F75.tmp 1768 3FE2.tmp 5060 406F.tmp 5096 411B.tmp 2388 41B7.tmp 2100 4263.tmp 1788 42D0.tmp 844 437C.tmp 1732 4438.tmp 4228 44D4.tmp 2956 4570.tmp 4988 462C.tmp 1432 46F7.tmp 3648 4793.tmp 2668 4820.tmp 4604 489D.tmp 1988 4939.tmp 2960 4A14.tmp 4292 4AB0.tmp 2568 4B1D.tmp 5056 4BBA.tmp 2064 4C85.tmp 212 4D02.tmp 2104 4D9E.tmp 5024 4E2B.tmp 4784 4E88.tmp 2800 4F05.tmp 4060 4F73.tmp 1904 4FC1.tmp 1444 500F.tmp 2996 505D.tmp 4856 50AB.tmp 1744 5109.tmp 2836 5167.tmp 5116 51B5.tmp 4568 5213.tmp 2316 5261.tmp 1640 52BF.tmp 2884 530D.tmp 4188 538A.tmp 3528 53D8.tmp 3988 5426.tmp 3256 54A3.tmp 1832 5501.tmp 3856 554F.tmp 2660 55AD.tmp 2396 560A.tmp 3360 5687.tmp 4164 56D5.tmp 4656 5724.tmp 452 5791.tmp 3532 57FE.tmp 3664 584C.tmp 1932 58BA.tmp 4252 5918.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 986E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 797C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-14_0c89e80a316fc35732c653dfe0a695a4_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9149.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A256.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A39E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5412.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7286.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D387.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B55C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1757.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7778.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 546F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 530D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 328F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8340.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9699.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3092 wrote to memory of 3796 3092 2026-08-14_0c89e80a316fc35732c653dfe0a695a4_elex_mafia_stealc_tofsee.exe 85 PID 3796 wrote to memory of 3472 3796 38CE.tmp 86 PID 3472 wrote to memory of 976 3472 397A.tmp 87 PID 976 wrote to memory of 3044 976 3A45.tmp 88 PID 3044 wrote to memory of 4580 3044 3B2F.tmp 89 PID 4580 wrote to memory of 4868 4580 3BCC.tmp 90 PID 4868 wrote to memory of 2612 4868 3C68.tmp 91 PID 2612 wrote to memory of 3060 2612 3D33.tmp 92 PID 3060 wrote to memory of 2552 3060 3DCF.tmp 93 PID 2552 wrote to memory of 2152 2552 3EAA.tmp 94 PID 2152 wrote to memory of 1768 2152 3F75.tmp 95 PID 1768 wrote to memory of 5060 1768 3FE2.tmp 96 PID 5060 wrote to memory of 5096 5060 406F.tmp 97 PID 5096 wrote to memory of 2388 5096 411B.tmp 98 PID 2388 wrote to memory of 2100 2388 41B7.tmp 99 PID 2100 wrote to memory of 1788 2100 4263.tmp 100 PID 1788 wrote to memory of 844 1788 42D0.tmp 101 PID 844 wrote to memory of 1732 844 437C.tmp 102 PID 1732 wrote to memory of 4228 1732 4438.tmp 103 PID 4228 wrote to memory of 2956 4228 44D4.tmp 104 PID 2956 wrote to memory of 4988 2956 4570.tmp 105 PID 4988 wrote to memory of 1432 4988 462C.tmp 106 PID 1432 wrote to memory of 3648 1432 46F7.tmp 107 PID 3648 wrote to memory of 2668 3648 4793.tmp 108 PID 2668 wrote to memory of 4604 2668 4820.tmp 109 PID 4604 wrote to memory of 1988 4604 489D.tmp 110 PID 1988 wrote to memory of 2960 1988 4939.tmp 111 PID 2960 wrote to memory of 4292 2960 4A14.tmp 112 PID 4292 wrote to memory of 2568 4292 4AB0.tmp 113 PID 2568 wrote to memory of 5056 2568 4B1D.tmp 114 PID 5056 wrote to memory of 2064 5056 4BBA.tmp 115 PID 2064 wrote to memory of 212 2064 4C85.tmp 116 PID 212 wrote to memory of 2104 212 4D02.tmp 117 PID 2104 wrote to memory of 5024 2104 4D9E.tmp 118 PID 5024 wrote to memory of 4784 5024 4E2B.tmp 119 PID 4784 wrote to memory of 2800 4784 4E88.tmp 120 PID 2800 wrote to memory of 4060 2800 4F05.tmp 121 PID 4060 wrote to memory of 1904 4060 4F73.tmp 122 PID 1904 wrote to memory of 1444 1904 4FC1.tmp 123 PID 1444 wrote to memory of 2996 1444 500F.tmp 124 PID 2996 wrote to memory of 4856 2996 505D.tmp 125 PID 4856 wrote to memory of 1744 4856 50AB.tmp 126 PID 1744 wrote to memory of 2836 1744 5109.tmp 127 PID 2836 wrote to memory of 5116 2836 5167.tmp 128 PID 5116 wrote to memory of 4568 5116 51B5.tmp 129 PID 4568 wrote to memory of 2316 4568 5213.tmp 130 PID 2316 wrote to memory of 1640 2316 5261.tmp 131 PID 1640 wrote to memory of 2884 1640 52BF.tmp 132 PID 2884 wrote to memory of 4188 2884 530D.tmp 133 PID 4188 wrote to memory of 3528 4188 538A.tmp 134 PID 3528 wrote to memory of 3988 3528 53D8.tmp 135 PID 3988 wrote to memory of 3256 3988 5426.tmp 136 PID 3256 wrote to memory of 1832 3256 54A3.tmp 137 PID 1832 wrote to memory of 3856 1832 5501.tmp 138 PID 3856 wrote to memory of 2660 3856 554F.tmp 139 PID 2660 wrote to memory of 2396 2660 55AD.tmp 140 PID 2396 wrote to memory of 3360 2396 560A.tmp 141 PID 3360 wrote to memory of 4164 3360 5687.tmp 142 PID 4164 wrote to memory of 4656 4164 56D5.tmp 143 PID 4656 wrote to memory of 452 4656 5724.tmp 144 PID 452 wrote to memory of 3532 452 5791.tmp 145 PID 3532 wrote to memory of 3664 3532 57FE.tmp 146 PID 3664 wrote to memory of 1932 3664 584C.tmp 147 PID 1932 wrote to memory of 4252 1932 58BA.tmp 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_0c89e80a316fc35732c653dfe0a695a4_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_0c89e80a316fc35732c653dfe0a695a4_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\3A45.tmp"C:\Users\Admin\AppData\Local\Temp\3A45.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\3BCC.tmp"C:\Users\Admin\AppData\Local\Temp\3BCC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\3C68.tmp"C:\Users\Admin\AppData\Local\Temp\3C68.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\3D33.tmp"C:\Users\Admin\AppData\Local\Temp\3D33.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\3DCF.tmp"C:\Users\Admin\AppData\Local\Temp\3DCF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\3F75.tmp"C:\Users\Admin\AppData\Local\Temp\3F75.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\406F.tmp"C:\Users\Admin\AppData\Local\Temp\406F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\411B.tmp"C:\Users\Admin\AppData\Local\Temp\411B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\41B7.tmp"C:\Users\Admin\AppData\Local\Temp\41B7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\4263.tmp"C:\Users\Admin\AppData\Local\Temp\4263.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\42D0.tmp"C:\Users\Admin\AppData\Local\Temp\42D0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\437C.tmp"C:\Users\Admin\AppData\Local\Temp\437C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\4438.tmp"C:\Users\Admin\AppData\Local\Temp\4438.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\44D4.tmp"C:\Users\Admin\AppData\Local\Temp\44D4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\4570.tmp"C:\Users\Admin\AppData\Local\Temp\4570.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\462C.tmp"C:\Users\Admin\AppData\Local\Temp\462C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\46F7.tmp"C:\Users\Admin\AppData\Local\Temp\46F7.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\4820.tmp"C:\Users\Admin\AppData\Local\Temp\4820.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\489D.tmp"C:\Users\Admin\AppData\Local\Temp\489D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\4939.tmp"C:\Users\Admin\AppData\Local\Temp\4939.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\4A14.tmp"C:\Users\Admin\AppData\Local\Temp\4A14.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\4C85.tmp"C:\Users\Admin\AppData\Local\Temp\4C85.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\4D02.tmp"C:\Users\Admin\AppData\Local\Temp\4D02.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\4E88.tmp"C:\Users\Admin\AppData\Local\Temp\4E88.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\4F05.tmp"C:\Users\Admin\AppData\Local\Temp\4F05.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\4F73.tmp"C:\Users\Admin\AppData\Local\Temp\4F73.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\500F.tmp"C:\Users\Admin\AppData\Local\Temp\500F.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\505D.tmp"C:\Users\Admin\AppData\Local\Temp\505D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\50AB.tmp"C:\Users\Admin\AppData\Local\Temp\50AB.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\5109.tmp"C:\Users\Admin\AppData\Local\Temp\5109.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\5167.tmp"C:\Users\Admin\AppData\Local\Temp\5167.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\51B5.tmp"C:\Users\Admin\AppData\Local\Temp\51B5.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\5213.tmp"C:\Users\Admin\AppData\Local\Temp\5213.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\5261.tmp"C:\Users\Admin\AppData\Local\Temp\5261.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\52BF.tmp"C:\Users\Admin\AppData\Local\Temp\52BF.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\530D.tmp"C:\Users\Admin\AppData\Local\Temp\530D.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\53D8.tmp"C:\Users\Admin\AppData\Local\Temp\53D8.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\5426.tmp"C:\Users\Admin\AppData\Local\Temp\5426.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\54A3.tmp"C:\Users\Admin\AppData\Local\Temp\54A3.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\5501.tmp"C:\Users\Admin\AppData\Local\Temp\5501.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\554F.tmp"C:\Users\Admin\AppData\Local\Temp\554F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\55AD.tmp"C:\Users\Admin\AppData\Local\Temp\55AD.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\560A.tmp"C:\Users\Admin\AppData\Local\Temp\560A.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\5687.tmp"C:\Users\Admin\AppData\Local\Temp\5687.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\56D5.tmp"C:\Users\Admin\AppData\Local\Temp\56D5.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\5724.tmp"C:\Users\Admin\AppData\Local\Temp\5724.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\5791.tmp"C:\Users\Admin\AppData\Local\Temp\5791.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\57FE.tmp"C:\Users\Admin\AppData\Local\Temp\57FE.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\584C.tmp"C:\Users\Admin\AppData\Local\Temp\584C.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"65⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\5975.tmp"C:\Users\Admin\AppData\Local\Temp\5975.tmp"66⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\59C3.tmp"C:\Users\Admin\AppData\Local\Temp\59C3.tmp"67⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"68⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"69⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"70⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"71⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"72⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"73⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\5C54.tmp"C:\Users\Admin\AppData\Local\Temp\5C54.tmp"74⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\5CC1.tmp"C:\Users\Admin\AppData\Local\Temp\5CC1.tmp"75⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\5D0F.tmp"C:\Users\Admin\AppData\Local\Temp\5D0F.tmp"76⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"C:\Users\Admin\AppData\Local\Temp\5D6D.tmp"77⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"78⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\5E48.tmp"C:\Users\Admin\AppData\Local\Temp\5E48.tmp"79⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\5E96.tmp"C:\Users\Admin\AppData\Local\Temp\5E96.tmp"80⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"81⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\5F61.tmp"C:\Users\Admin\AppData\Local\Temp\5F61.tmp"82⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\600D.tmp"C:\Users\Admin\AppData\Local\Temp\600D.tmp"84⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\605B.tmp"C:\Users\Admin\AppData\Local\Temp\605B.tmp"85⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\60B9.tmp"C:\Users\Admin\AppData\Local\Temp\60B9.tmp"86⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\6126.tmp"C:\Users\Admin\AppData\Local\Temp\6126.tmp"87⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\6193.tmp"C:\Users\Admin\AppData\Local\Temp\6193.tmp"88⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\61F1.tmp"C:\Users\Admin\AppData\Local\Temp\61F1.tmp"89⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\623F.tmp"C:\Users\Admin\AppData\Local\Temp\623F.tmp"90⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\629D.tmp"C:\Users\Admin\AppData\Local\Temp\629D.tmp"91⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\62FB.tmp"C:\Users\Admin\AppData\Local\Temp\62FB.tmp"92⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\6349.tmp"C:\Users\Admin\AppData\Local\Temp\6349.tmp"93⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\63A7.tmp"C:\Users\Admin\AppData\Local\Temp\63A7.tmp"94⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\6404.tmp"C:\Users\Admin\AppData\Local\Temp\6404.tmp"95⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\6453.tmp"C:\Users\Admin\AppData\Local\Temp\6453.tmp"96⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\64B0.tmp"C:\Users\Admin\AppData\Local\Temp\64B0.tmp"97⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\650E.tmp"C:\Users\Admin\AppData\Local\Temp\650E.tmp"98⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\658B.tmp"C:\Users\Admin\AppData\Local\Temp\658B.tmp"99⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\65E9.tmp"C:\Users\Admin\AppData\Local\Temp\65E9.tmp"100⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\6637.tmp"C:\Users\Admin\AppData\Local\Temp\6637.tmp"101⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\6685.tmp"C:\Users\Admin\AppData\Local\Temp\6685.tmp"102⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\66F2.tmp"C:\Users\Admin\AppData\Local\Temp\66F2.tmp"103⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\6760.tmp"C:\Users\Admin\AppData\Local\Temp\6760.tmp"104⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\67AE.tmp"C:\Users\Admin\AppData\Local\Temp\67AE.tmp"105⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\67FC.tmp"C:\Users\Admin\AppData\Local\Temp\67FC.tmp"106⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\6869.tmp"C:\Users\Admin\AppData\Local\Temp\6869.tmp"107⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\68B8.tmp"C:\Users\Admin\AppData\Local\Temp\68B8.tmp"108⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\6906.tmp"C:\Users\Admin\AppData\Local\Temp\6906.tmp"109⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\6954.tmp"C:\Users\Admin\AppData\Local\Temp\6954.tmp"110⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\69B2.tmp"C:\Users\Admin\AppData\Local\Temp\69B2.tmp"111⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\6A00.tmp"C:\Users\Admin\AppData\Local\Temp\6A00.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\6A4E.tmp"C:\Users\Admin\AppData\Local\Temp\6A4E.tmp"113⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\6A9C.tmp"C:\Users\Admin\AppData\Local\Temp\6A9C.tmp"114⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"115⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\6B48.tmp"C:\Users\Admin\AppData\Local\Temp\6B48.tmp"116⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\6BB5.tmp"C:\Users\Admin\AppData\Local\Temp\6BB5.tmp"117⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\6C03.tmp"C:\Users\Admin\AppData\Local\Temp\6C03.tmp"118⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\6C71.tmp"C:\Users\Admin\AppData\Local\Temp\6C71.tmp"119⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"120⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"121⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\6D6B.tmp"C:\Users\Admin\AppData\Local\Temp\6D6B.tmp"122⤵PID:1684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-