Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/08/2026, 19:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_e7153399ebe9e122c56cd23faf57f1ab_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_e7153399ebe9e122c56cd23faf57f1ab_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-16_e7153399ebe9e122c56cd23faf57f1ab_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260816-ymmcdawdpe
- SHA256 4082b641d4c0fbe1ee3598184f7b2bcba10442ea0f880f4e62b09669a8448173
- MD5 e7153399ebe9e122c56cd23faf57f1ab
- SHA1 1b2135e4bbe7c5d933ea7ca0e4b4df156baabad1
- SHA512 035fcd19df14758ec02bb88eb4d5562937ab099b958e1af7db707428ad64942cf7c99aa819d613d525970ef15c0bcdd14f4be4083ba26bd4f37704672b43b8d8
- SSDEEP 12288:NU5rCOTeijIAHGxXw6MbwwP2u4UCN6CPF4OTZwlH4Hp:NUQOJjTmxDMv2u4UCN6Q4OTSlH4Hp
- TLSH T11AB4E126B685C132E6C201711ADAEBB2693F7C76572694C73B94622E2FB13E1C375307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2256 40EC.tmp 3360 41A8.tmp 2372 4263.tmp 2096 435D.tmp 3424 43EA.tmp 3988 4476.tmp 2120 4551.tmp 3556 45DE.tmp 2736 465B.tmp 2940 4707.tmp 2264 4793.tmp 2944 484F.tmp 3540 48FB.tmp 656 49C6.tmp 1160 4AB0.tmp 1204 4B4C.tmp 2716 4BC9.tmp 3472 4C85.tmp 2400 4D11.tmp 4468 4D7F.tmp 3876 4E1B.tmp 1776 4E98.tmp 1472 4F34.tmp 3604 4FD1.tmp 1320 506D.tmp 4416 5109.tmp 3852 51A5.tmp 208 5251.tmp 1256 52ED.tmp 4080 536A.tmp 2756 5407.tmp 744 5493.tmp 2132 553F.tmp 1784 559D.tmp 2864 55EB.tmp 1788 5639.tmp 2888 5687.tmp 4312 56D5.tmp 3868 5724.tmp 4436 5772.tmp 4672 57C0.tmp 2552 580E.tmp 3508 586C.tmp 4652 58BA.tmp 4636 5908.tmp 4084 5966.tmp 5004 59B4.tmp 4140 5A02.tmp 2916 5A60.tmp 2008 5AAE.tmp 2128 5B0C.tmp 1804 5B69.tmp 3976 5BB7.tmp 2628 5C06.tmp 1468 5C63.tmp 5044 5CC1.tmp 2740 5D0F.tmp 1664 5D5D.tmp 4472 5DDA.tmp 3156 5E38.tmp 4684 5E86.tmp 1832 5ED4.tmp 5008 5F22.tmp 4228 5F71.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 484F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7470.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6193.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 631A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4476.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 911B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9601.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D77F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1311.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E819.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 300F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 335B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 485A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E52B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A714.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 746B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8534.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DCF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7683.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1432 wrote to memory of 2256 1432 2026-08-16_e7153399ebe9e122c56cd23faf57f1ab_elex_mafia_stealc_tofsee.exe 84 PID 2256 wrote to memory of 3360 2256 40EC.tmp 85 PID 3360 wrote to memory of 2372 3360 41A8.tmp 86 PID 2372 wrote to memory of 2096 2372 4263.tmp 87 PID 2096 wrote to memory of 3424 2096 435D.tmp 88 PID 3424 wrote to memory of 3988 3424 43EA.tmp 89 PID 3988 wrote to memory of 2120 3988 4476.tmp 90 PID 2120 wrote to memory of 3556 2120 4551.tmp 91 PID 3556 wrote to memory of 2736 3556 45DE.tmp 92 PID 2736 wrote to memory of 2940 2736 465B.tmp 93 PID 2940 wrote to memory of 2264 2940 4707.tmp 94 PID 2264 wrote to memory of 2944 2264 4793.tmp 95 PID 2944 wrote to memory of 3540 2944 484F.tmp 96 PID 3540 wrote to memory of 656 3540 48FB.tmp 97 PID 656 wrote to memory of 1160 656 49C6.tmp 98 PID 1160 wrote to memory of 1204 1160 4AB0.tmp 99 PID 1204 wrote to memory of 2716 1204 4B4C.tmp 100 PID 2716 wrote to memory of 3472 2716 4BC9.tmp 101 PID 3472 wrote to memory of 2400 3472 4C85.tmp 102 PID 2400 wrote to memory of 4468 2400 4D11.tmp 103 PID 4468 wrote to memory of 3876 4468 4D7F.tmp 104 PID 3876 wrote to memory of 1776 3876 4E1B.tmp 105 PID 1776 wrote to memory of 1472 1776 4E98.tmp 106 PID 1472 wrote to memory of 3604 1472 4F34.tmp 107 PID 3604 wrote to memory of 1320 3604 4FD1.tmp 108 PID 1320 wrote to memory of 4416 1320 506D.tmp 109 PID 4416 wrote to memory of 3852 4416 5109.tmp 110 PID 3852 wrote to memory of 208 3852 51A5.tmp 111 PID 208 wrote to memory of 1256 208 5251.tmp 112 PID 1256 wrote to memory of 4080 1256 52ED.tmp 113 PID 4080 wrote to memory of 2756 4080 536A.tmp 114 PID 2756 wrote to memory of 744 2756 5407.tmp 115 PID 744 wrote to memory of 2132 744 5493.tmp 116 PID 2132 wrote to memory of 1784 2132 553F.tmp 117 PID 1784 wrote to memory of 2864 1784 559D.tmp 118 PID 2864 wrote to memory of 1788 2864 55EB.tmp 119 PID 1788 wrote to memory of 2888 1788 5639.tmp 120 PID 2888 wrote to memory of 4312 2888 5687.tmp 121 PID 4312 wrote to memory of 3868 4312 56D5.tmp 122 PID 3868 wrote to memory of 4436 3868 5724.tmp 123 PID 4436 wrote to memory of 4672 4436 5772.tmp 124 PID 4672 wrote to memory of 2552 4672 57C0.tmp 125 PID 2552 wrote to memory of 3508 2552 580E.tmp 126 PID 3508 wrote to memory of 4652 3508 586C.tmp 127 PID 4652 wrote to memory of 4636 4652 58BA.tmp 128 PID 4636 wrote to memory of 4084 4636 5908.tmp 129 PID 4084 wrote to memory of 5004 4084 5966.tmp 130 PID 5004 wrote to memory of 4140 5004 59B4.tmp 131 PID 4140 wrote to memory of 2916 4140 5A02.tmp 132 PID 2916 wrote to memory of 2008 2916 5A60.tmp 133 PID 2008 wrote to memory of 2128 2008 5AAE.tmp 134 PID 2128 wrote to memory of 1804 2128 5B0C.tmp 135 PID 1804 wrote to memory of 3976 1804 5B69.tmp 136 PID 3976 wrote to memory of 2628 3976 5BB7.tmp 137 PID 2628 wrote to memory of 1468 2628 5C06.tmp 138 PID 1468 wrote to memory of 5044 1468 5C63.tmp 139 PID 5044 wrote to memory of 2740 5044 5CC1.tmp 140 PID 2740 wrote to memory of 1664 2740 5D0F.tmp 141 PID 1664 wrote to memory of 4472 1664 5D5D.tmp 142 PID 4472 wrote to memory of 3156 4472 5DDA.tmp 143 PID 3156 wrote to memory of 4684 3156 5E38.tmp 144 PID 4684 wrote to memory of 1832 4684 5E86.tmp 145 PID 1832 wrote to memory of 5008 1832 5ED4.tmp 146 PID 5008 wrote to memory of 4228 5008 5F22.tmp 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_e7153399ebe9e122c56cd23faf57f1ab_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_e7153399ebe9e122c56cd23faf57f1ab_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\40EC.tmp"C:\Users\Admin\AppData\Local\Temp\40EC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\41A8.tmp"C:\Users\Admin\AppData\Local\Temp\41A8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\4263.tmp"C:\Users\Admin\AppData\Local\Temp\4263.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\435D.tmp"C:\Users\Admin\AppData\Local\Temp\435D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\43EA.tmp"C:\Users\Admin\AppData\Local\Temp\43EA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\4476.tmp"C:\Users\Admin\AppData\Local\Temp\4476.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\45DE.tmp"C:\Users\Admin\AppData\Local\Temp\45DE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\465B.tmp"C:\Users\Admin\AppData\Local\Temp\465B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\4707.tmp"C:\Users\Admin\AppData\Local\Temp\4707.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\484F.tmp"C:\Users\Admin\AppData\Local\Temp\484F.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\48FB.tmp"C:\Users\Admin\AppData\Local\Temp\48FB.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\49C6.tmp"C:\Users\Admin\AppData\Local\Temp\49C6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\4C85.tmp"C:\Users\Admin\AppData\Local\Temp\4C85.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\4D11.tmp"C:\Users\Admin\AppData\Local\Temp\4D11.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\4D7F.tmp"C:\Users\Admin\AppData\Local\Temp\4D7F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\4E98.tmp"C:\Users\Admin\AppData\Local\Temp\4E98.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\4F34.tmp"C:\Users\Admin\AppData\Local\Temp\4F34.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\506D.tmp"C:\Users\Admin\AppData\Local\Temp\506D.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\5109.tmp"C:\Users\Admin\AppData\Local\Temp\5109.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\51A5.tmp"C:\Users\Admin\AppData\Local\Temp\51A5.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\5251.tmp"C:\Users\Admin\AppData\Local\Temp\5251.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\52ED.tmp"C:\Users\Admin\AppData\Local\Temp\52ED.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\536A.tmp"C:\Users\Admin\AppData\Local\Temp\536A.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\5407.tmp"C:\Users\Admin\AppData\Local\Temp\5407.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\5493.tmp"C:\Users\Admin\AppData\Local\Temp\5493.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\553F.tmp"C:\Users\Admin\AppData\Local\Temp\553F.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\559D.tmp"C:\Users\Admin\AppData\Local\Temp\559D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\55EB.tmp"C:\Users\Admin\AppData\Local\Temp\55EB.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\5639.tmp"C:\Users\Admin\AppData\Local\Temp\5639.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\5687.tmp"C:\Users\Admin\AppData\Local\Temp\5687.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\56D5.tmp"C:\Users\Admin\AppData\Local\Temp\56D5.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\5724.tmp"C:\Users\Admin\AppData\Local\Temp\5724.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\5772.tmp"C:\Users\Admin\AppData\Local\Temp\5772.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\57C0.tmp"C:\Users\Admin\AppData\Local\Temp\57C0.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\580E.tmp"C:\Users\Admin\AppData\Local\Temp\580E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\586C.tmp"C:\Users\Admin\AppData\Local\Temp\586C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\5908.tmp"C:\Users\Admin\AppData\Local\Temp\5908.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\5A60.tmp"C:\Users\Admin\AppData\Local\Temp\5A60.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\5B69.tmp"C:\Users\Admin\AppData\Local\Temp\5B69.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\5C06.tmp"C:\Users\Admin\AppData\Local\Temp\5C06.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\5C63.tmp"C:\Users\Admin\AppData\Local\Temp\5C63.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\5CC1.tmp"C:\Users\Admin\AppData\Local\Temp\5CC1.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\5D0F.tmp"C:\Users\Admin\AppData\Local\Temp\5D0F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\5E38.tmp"C:\Users\Admin\AppData\Local\Temp\5E38.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\5E86.tmp"C:\Users\Admin\AppData\Local\Temp\5E86.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\5ED4.tmp"C:\Users\Admin\AppData\Local\Temp\5ED4.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\5F22.tmp"C:\Users\Admin\AppData\Local\Temp\5F22.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"65⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"66⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\601C.tmp"C:\Users\Admin\AppData\Local\Temp\601C.tmp"67⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\607A.tmp"C:\Users\Admin\AppData\Local\Temp\607A.tmp"68⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\60D8.tmp"C:\Users\Admin\AppData\Local\Temp\60D8.tmp"69⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\6136.tmp"C:\Users\Admin\AppData\Local\Temp\6136.tmp"70⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\6193.tmp"C:\Users\Admin\AppData\Local\Temp\6193.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\6201.tmp"C:\Users\Admin\AppData\Local\Temp\6201.tmp"72⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\625F.tmp"C:\Users\Admin\AppData\Local\Temp\625F.tmp"73⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\62BC.tmp"C:\Users\Admin\AppData\Local\Temp\62BC.tmp"74⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\631A.tmp"C:\Users\Admin\AppData\Local\Temp\631A.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"76⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\63E5.tmp"C:\Users\Admin\AppData\Local\Temp\63E5.tmp"77⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\6433.tmp"C:\Users\Admin\AppData\Local\Temp\6433.tmp"78⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\6481.tmp"C:\Users\Admin\AppData\Local\Temp\6481.tmp"79⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\64DF.tmp"C:\Users\Admin\AppData\Local\Temp\64DF.tmp"80⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\653D.tmp"C:\Users\Admin\AppData\Local\Temp\653D.tmp"81⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\658B.tmp"C:\Users\Admin\AppData\Local\Temp\658B.tmp"82⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\65F8.tmp"C:\Users\Admin\AppData\Local\Temp\65F8.tmp"83⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\6647.tmp"C:\Users\Admin\AppData\Local\Temp\6647.tmp"84⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\66A4.tmp"C:\Users\Admin\AppData\Local\Temp\66A4.tmp"85⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\66F2.tmp"C:\Users\Admin\AppData\Local\Temp\66F2.tmp"86⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\6750.tmp"C:\Users\Admin\AppData\Local\Temp\6750.tmp"87⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\679E.tmp"C:\Users\Admin\AppData\Local\Temp\679E.tmp"88⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\681B.tmp"C:\Users\Admin\AppData\Local\Temp\681B.tmp"89⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\6869.tmp"C:\Users\Admin\AppData\Local\Temp\6869.tmp"90⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\68B8.tmp"C:\Users\Admin\AppData\Local\Temp\68B8.tmp"91⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\6906.tmp"C:\Users\Admin\AppData\Local\Temp\6906.tmp"92⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\6973.tmp"C:\Users\Admin\AppData\Local\Temp\6973.tmp"93⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\69E0.tmp"C:\Users\Admin\AppData\Local\Temp\69E0.tmp"94⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"95⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"96⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\6B29.tmp"C:\Users\Admin\AppData\Local\Temp\6B29.tmp"97⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\6B77.tmp"C:\Users\Admin\AppData\Local\Temp\6B77.tmp"98⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\6BC5.tmp"C:\Users\Admin\AppData\Local\Temp\6BC5.tmp"99⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\6C42.tmp"C:\Users\Admin\AppData\Local\Temp\6C42.tmp"100⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"101⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"102⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"103⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\6D9A.tmp"C:\Users\Admin\AppData\Local\Temp\6D9A.tmp"104⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\6DE8.tmp"C:\Users\Admin\AppData\Local\Temp\6DE8.tmp"105⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\6E36.tmp"C:\Users\Admin\AppData\Local\Temp\6E36.tmp"106⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\6E84.tmp"C:\Users\Admin\AppData\Local\Temp\6E84.tmp"107⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\6F30.tmp"C:\Users\Admin\AppData\Local\Temp\6F30.tmp"109⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\6F9D.tmp"C:\Users\Admin\AppData\Local\Temp\6F9D.tmp"110⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\6FEB.tmp"C:\Users\Admin\AppData\Local\Temp\6FEB.tmp"111⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\7059.tmp"C:\Users\Admin\AppData\Local\Temp\7059.tmp"112⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\70A7.tmp"C:\Users\Admin\AppData\Local\Temp\70A7.tmp"113⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\7114.tmp"C:\Users\Admin\AppData\Local\Temp\7114.tmp"114⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\7162.tmp"C:\Users\Admin\AppData\Local\Temp\7162.tmp"115⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\71B0.tmp"C:\Users\Admin\AppData\Local\Temp\71B0.tmp"116⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\720E.tmp"C:\Users\Admin\AppData\Local\Temp\720E.tmp"117⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\725C.tmp"C:\Users\Admin\AppData\Local\Temp\725C.tmp"118⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\72CA.tmp"C:\Users\Admin\AppData\Local\Temp\72CA.tmp"119⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\7318.tmp"C:\Users\Admin\AppData\Local\Temp\7318.tmp"120⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\7366.tmp"C:\Users\Admin\AppData\Local\Temp\7366.tmp"121⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\73C4.tmp"C:\Users\Admin\AppData\Local\Temp\73C4.tmp"122⤵PID:4920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-