Analysis
- max time kernel
150s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 22:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_31d8b14330d5348e7f9f09a646008c83_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_31d8b14330d5348e7f9f09a646008c83_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-29_31d8b14330d5348e7f9f09a646008c83_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260930-2d6ans1wew
- SHA256 644be1f7e53db53bdc440a6407bacbf30280fa31389a73d6aa42d02376c2e3ff
- MD5 31d8b14330d5348e7f9f09a646008c83
- SHA1 7922863859298b0c25a1ffab9778c045dc4213c2
- SHA512 09ab437b989d81d33d8bb399d74c0c2f09347b82376c2f9173aca6a8cd6c288bda0c59d4fd30c4f8feec996cdd1451035e82a0666a988a4463e22b62ae220ecb
- SSDEEP 12288:yU5rCOTeiNhL1YbiTFKi4l65TMJenOZcbZjbZ:yUQOJNDHFd/d0ZcbRb
- TLSH T1F8B4F1217688C032E6E202314EE6EBB1693A7D355B2664C77B84777E6FB42E19374343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3668 A7C4.tmp 4868 A841.tmp 2460 A8FD.tmp 1608 A999.tmp 3956 AA45.tmp 4472 AAD1.tmp 2604 AB3F.tmp 1020 ABCB.tmp 4412 AC48.tmp 1632 ACE5.tmp 5040 AD71.tmp 4236 AE0E.tmp 2624 AE8B.tmp 4976 AF17.tmp 4928 AF75.tmp 804 B002.tmp 4144 B09E.tmp 5084 B11B.tmp 1656 B188.tmp 4608 B205.tmp 3984 B273.tmp 464 B2FF.tmp 4464 B38C.tmp 4700 B409.tmp 3416 B4A5.tmp 1388 B561.tmp 4044 B61C.tmp 2300 B6A9.tmp 2736 B716.tmp 1392 B7A3.tmp 3272 B810.tmp 4312 B88D.tmp 3484 B8FA.tmp 1540 B949.tmp 2660 B997.tmp 2024 B9F4.tmp 5012 BA52.tmp 4164 BAC0.tmp 3976 BB2D.tmp 3784 BB7B.tmp 5064 BBC9.tmp 2308 BC17.tmp 2064 BC65.tmp 1128 BCC3.tmp 3712 BD50.tmp 4268 BDCD.tmp 4136 BE3A.tmp 3436 BE98.tmp 3320 BEF6.tmp 2556 BF44.tmp 1676 BFA2.tmp 3044 BFF0.tmp 2896 C03E.tmp 4324 C08C.tmp 4896 C0DA.tmp 4884 C128.tmp 1384 C176.tmp 204 C1C4.tmp 3680 C213.tmp 3948 C261.tmp 4780 C2BE.tmp 4684 C30D.tmp 3428 C35B.tmp 3648 C3A9.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1582.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1786.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6112.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 699.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 162E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 962B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C029.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 108C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1406.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 985E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 570F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E46B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1975.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1534.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 193B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C81D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9DE.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4620 wrote to memory of 3668 4620 2026-09-29_31d8b14330d5348e7f9f09a646008c83_elex_mafia_stealc_tofsee.exe 85 PID 3668 wrote to memory of 4868 3668 A7C4.tmp 86 PID 4868 wrote to memory of 2460 4868 A841.tmp 89 PID 2460 wrote to memory of 1608 2460 A8FD.tmp 91 PID 1608 wrote to memory of 3956 1608 A999.tmp 92 PID 3956 wrote to memory of 4472 3956 AA45.tmp 93 PID 4472 wrote to memory of 2604 4472 AAD1.tmp 94 PID 2604 wrote to memory of 1020 2604 AB3F.tmp 96 PID 1020 wrote to memory of 4412 1020 ABCB.tmp 97 PID 4412 wrote to memory of 1632 4412 AC48.tmp 98 PID 1632 wrote to memory of 5040 1632 ACE5.tmp 99 PID 5040 wrote to memory of 4236 5040 AD71.tmp 100 PID 4236 wrote to memory of 2624 4236 AE0E.tmp 101 PID 2624 wrote to memory of 4976 2624 AE8B.tmp 102 PID 4976 wrote to memory of 4928 4976 AF17.tmp 103 PID 4928 wrote to memory of 804 4928 AF75.tmp 104 PID 804 wrote to memory of 4144 804 B002.tmp 105 PID 4144 wrote to memory of 5084 4144 B09E.tmp 106 PID 5084 wrote to memory of 1656 5084 B11B.tmp 107 PID 1656 wrote to memory of 4608 1656 B188.tmp 108 PID 4608 wrote to memory of 3984 4608 B205.tmp 109 PID 3984 wrote to memory of 464 3984 B273.tmp 112 PID 464 wrote to memory of 4464 464 B2FF.tmp 113 PID 4464 wrote to memory of 4700 4464 B38C.tmp 114 PID 4700 wrote to memory of 3416 4700 B409.tmp 115 PID 3416 wrote to memory of 1388 3416 B4A5.tmp 116 PID 1388 wrote to memory of 4044 1388 B561.tmp 117 PID 4044 wrote to memory of 2300 4044 B61C.tmp 118 PID 2300 wrote to memory of 2736 2300 B6A9.tmp 119 PID 2736 wrote to memory of 1392 2736 B716.tmp 121 PID 1392 wrote to memory of 3272 1392 B7A3.tmp 122 PID 3272 wrote to memory of 4312 3272 B810.tmp 123 PID 4312 wrote to memory of 3484 4312 B88D.tmp 125 PID 3484 wrote to memory of 1540 3484 B8FA.tmp 126 PID 1540 wrote to memory of 2660 1540 B949.tmp 127 PID 2660 wrote to memory of 2024 2660 B997.tmp 128 PID 2024 wrote to memory of 5012 2024 B9F4.tmp 129 PID 5012 wrote to memory of 4164 5012 BA52.tmp 130 PID 4164 wrote to memory of 3976 4164 BAC0.tmp 131 PID 3976 wrote to memory of 3784 3976 BB2D.tmp 132 PID 3784 wrote to memory of 5064 3784 BB7B.tmp 133 PID 5064 wrote to memory of 2308 5064 BBC9.tmp 134 PID 2308 wrote to memory of 2064 2308 BC17.tmp 135 PID 2064 wrote to memory of 1128 2064 BC65.tmp 136 PID 1128 wrote to memory of 3712 1128 BCC3.tmp 137 PID 3712 wrote to memory of 4268 3712 BD50.tmp 138 PID 4268 wrote to memory of 4136 4268 BDCD.tmp 139 PID 4136 wrote to memory of 3436 4136 BE3A.tmp 140 PID 3436 wrote to memory of 3320 3436 BE98.tmp 141 PID 3320 wrote to memory of 2556 3320 BEF6.tmp 142 PID 2556 wrote to memory of 1676 2556 BF44.tmp 143 PID 1676 wrote to memory of 3044 1676 BFA2.tmp 144 PID 3044 wrote to memory of 2896 3044 BFF0.tmp 145 PID 2896 wrote to memory of 4324 2896 C03E.tmp 146 PID 4324 wrote to memory of 4896 4324 C08C.tmp 147 PID 4896 wrote to memory of 4884 4896 C0DA.tmp 148 PID 4884 wrote to memory of 1384 4884 C128.tmp 149 PID 1384 wrote to memory of 204 1384 C176.tmp 150 PID 204 wrote to memory of 3680 204 C1C4.tmp 151 PID 3680 wrote to memory of 3948 3680 C213.tmp 152 PID 3948 wrote to memory of 4780 3948 C261.tmp 153 PID 4780 wrote to memory of 4684 4780 C2BE.tmp 154 PID 4684 wrote to memory of 3428 4684 C30D.tmp 155 PID 3428 wrote to memory of 3648 3428 C35B.tmp 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_31d8b14330d5348e7f9f09a646008c83_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_31d8b14330d5348e7f9f09a646008c83_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\A841.tmp"C:\Users\Admin\AppData\Local\Temp\A841.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\A8FD.tmp"C:\Users\Admin\AppData\Local\Temp\A8FD.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\A999.tmp"C:\Users\Admin\AppData\Local\Temp\A999.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\AA45.tmp"C:\Users\Admin\AppData\Local\Temp\AA45.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\AAD1.tmp"C:\Users\Admin\AppData\Local\Temp\AAD1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\AB3F.tmp"C:\Users\Admin\AppData\Local\Temp\AB3F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\ABCB.tmp"C:\Users\Admin\AppData\Local\Temp\ABCB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\AC48.tmp"C:\Users\Admin\AppData\Local\Temp\AC48.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\ACE5.tmp"C:\Users\Admin\AppData\Local\Temp\ACE5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\AD71.tmp"C:\Users\Admin\AppData\Local\Temp\AD71.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\AE0E.tmp"C:\Users\Admin\AppData\Local\Temp\AE0E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\AE8B.tmp"C:\Users\Admin\AppData\Local\Temp\AE8B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\AF17.tmp"C:\Users\Admin\AppData\Local\Temp\AF17.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\AF75.tmp"C:\Users\Admin\AppData\Local\Temp\AF75.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\B002.tmp"C:\Users\Admin\AppData\Local\Temp\B002.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\B09E.tmp"C:\Users\Admin\AppData\Local\Temp\B09E.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\B11B.tmp"C:\Users\Admin\AppData\Local\Temp\B11B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\B188.tmp"C:\Users\Admin\AppData\Local\Temp\B188.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\B205.tmp"C:\Users\Admin\AppData\Local\Temp\B205.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\B273.tmp"C:\Users\Admin\AppData\Local\Temp\B273.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\B2FF.tmp"C:\Users\Admin\AppData\Local\Temp\B2FF.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\B38C.tmp"C:\Users\Admin\AppData\Local\Temp\B38C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\B409.tmp"C:\Users\Admin\AppData\Local\Temp\B409.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\B4A5.tmp"C:\Users\Admin\AppData\Local\Temp\B4A5.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\B561.tmp"C:\Users\Admin\AppData\Local\Temp\B561.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\B61C.tmp"C:\Users\Admin\AppData\Local\Temp\B61C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\B6A9.tmp"C:\Users\Admin\AppData\Local\Temp\B6A9.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\B716.tmp"C:\Users\Admin\AppData\Local\Temp\B716.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\B7A3.tmp"C:\Users\Admin\AppData\Local\Temp\B7A3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\B810.tmp"C:\Users\Admin\AppData\Local\Temp\B810.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\B88D.tmp"C:\Users\Admin\AppData\Local\Temp\B88D.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\B949.tmp"C:\Users\Admin\AppData\Local\Temp\B949.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\B997.tmp"C:\Users\Admin\AppData\Local\Temp\B997.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\B9F4.tmp"C:\Users\Admin\AppData\Local\Temp\B9F4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\BA52.tmp"C:\Users\Admin\AppData\Local\Temp\BA52.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\BAC0.tmp"C:\Users\Admin\AppData\Local\Temp\BAC0.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\BB2D.tmp"C:\Users\Admin\AppData\Local\Temp\BB2D.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\BB7B.tmp"C:\Users\Admin\AppData\Local\Temp\BB7B.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\BBC9.tmp"C:\Users\Admin\AppData\Local\Temp\BBC9.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\BC17.tmp"C:\Users\Admin\AppData\Local\Temp\BC17.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\BC65.tmp"C:\Users\Admin\AppData\Local\Temp\BC65.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\BCC3.tmp"C:\Users\Admin\AppData\Local\Temp\BCC3.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\BD50.tmp"C:\Users\Admin\AppData\Local\Temp\BD50.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\BDCD.tmp"C:\Users\Admin\AppData\Local\Temp\BDCD.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\BE3A.tmp"C:\Users\Admin\AppData\Local\Temp\BE3A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\BE98.tmp"C:\Users\Admin\AppData\Local\Temp\BE98.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\BEF6.tmp"C:\Users\Admin\AppData\Local\Temp\BEF6.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\BF44.tmp"C:\Users\Admin\AppData\Local\Temp\BF44.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\BFA2.tmp"C:\Users\Admin\AppData\Local\Temp\BFA2.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\BFF0.tmp"C:\Users\Admin\AppData\Local\Temp\BFF0.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\C03E.tmp"C:\Users\Admin\AppData\Local\Temp\C03E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\C08C.tmp"C:\Users\Admin\AppData\Local\Temp\C08C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\C0DA.tmp"C:\Users\Admin\AppData\Local\Temp\C0DA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\C128.tmp"C:\Users\Admin\AppData\Local\Temp\C128.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\C176.tmp"C:\Users\Admin\AppData\Local\Temp\C176.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\C213.tmp"C:\Users\Admin\AppData\Local\Temp\C213.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\C261.tmp"C:\Users\Admin\AppData\Local\Temp\C261.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\C2BE.tmp"C:\Users\Admin\AppData\Local\Temp\C2BE.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\C30D.tmp"C:\Users\Admin\AppData\Local\Temp\C30D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\C35B.tmp"C:\Users\Admin\AppData\Local\Temp\C35B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\C3A9.tmp"C:\Users\Admin\AppData\Local\Temp\C3A9.tmp"65⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\C3F7.tmp"C:\Users\Admin\AppData\Local\Temp\C3F7.tmp"66⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\C445.tmp"C:\Users\Admin\AppData\Local\Temp\C445.tmp"67⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\C493.tmp"C:\Users\Admin\AppData\Local\Temp\C493.tmp"68⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\C4F1.tmp"C:\Users\Admin\AppData\Local\Temp\C4F1.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\C55E.tmp"C:\Users\Admin\AppData\Local\Temp\C55E.tmp"70⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\C5AC.tmp"C:\Users\Admin\AppData\Local\Temp\C5AC.tmp"71⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\C5FB.tmp"C:\Users\Admin\AppData\Local\Temp\C5FB.tmp"72⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\C649.tmp"C:\Users\Admin\AppData\Local\Temp\C649.tmp"73⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\C6B6.tmp"C:\Users\Admin\AppData\Local\Temp\C6B6.tmp"74⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\C714.tmp"C:\Users\Admin\AppData\Local\Temp\C714.tmp"75⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\C762.tmp"C:\Users\Admin\AppData\Local\Temp\C762.tmp"76⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"77⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\C81D.tmp"C:\Users\Admin\AppData\Local\Temp\C81D.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\C86C.tmp"C:\Users\Admin\AppData\Local\Temp\C86C.tmp"79⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"C:\Users\Admin\AppData\Local\Temp\C8BA.tmp"80⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\C908.tmp"C:\Users\Admin\AppData\Local\Temp\C908.tmp"81⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\C956.tmp"C:\Users\Admin\AppData\Local\Temp\C956.tmp"82⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\C9A4.tmp"C:\Users\Admin\AppData\Local\Temp\C9A4.tmp"83⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\C9F2.tmp"C:\Users\Admin\AppData\Local\Temp\C9F2.tmp"84⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\CA40.tmp"C:\Users\Admin\AppData\Local\Temp\CA40.tmp"85⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\CAAE.tmp"C:\Users\Admin\AppData\Local\Temp\CAAE.tmp"86⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\CAFC.tmp"C:\Users\Admin\AppData\Local\Temp\CAFC.tmp"87⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"88⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\CB98.tmp"C:\Users\Admin\AppData\Local\Temp\CB98.tmp"89⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"90⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\CC54.tmp"C:\Users\Admin\AppData\Local\Temp\CC54.tmp"91⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"93⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\CD6D.tmp"C:\Users\Admin\AppData\Local\Temp\CD6D.tmp"94⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\CDCB.tmp"C:\Users\Admin\AppData\Local\Temp\CDCB.tmp"95⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\CE28.tmp"C:\Users\Admin\AppData\Local\Temp\CE28.tmp"96⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\CE86.tmp"C:\Users\Admin\AppData\Local\Temp\CE86.tmp"97⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\CED4.tmp"C:\Users\Admin\AppData\Local\Temp\CED4.tmp"98⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\CF22.tmp"C:\Users\Admin\AppData\Local\Temp\CF22.tmp"99⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\CF80.tmp"C:\Users\Admin\AppData\Local\Temp\CF80.tmp"100⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\CFCE.tmp"C:\Users\Admin\AppData\Local\Temp\CFCE.tmp"101⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\D02C.tmp"C:\Users\Admin\AppData\Local\Temp\D02C.tmp"102⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\D07A.tmp"C:\Users\Admin\AppData\Local\Temp\D07A.tmp"103⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\D0D8.tmp"C:\Users\Admin\AppData\Local\Temp\D0D8.tmp"104⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\D126.tmp"C:\Users\Admin\AppData\Local\Temp\D126.tmp"105⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\D174.tmp"C:\Users\Admin\AppData\Local\Temp\D174.tmp"106⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\D1D2.tmp"C:\Users\Admin\AppData\Local\Temp\D1D2.tmp"107⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\D220.tmp"C:\Users\Admin\AppData\Local\Temp\D220.tmp"108⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\D26E.tmp"C:\Users\Admin\AppData\Local\Temp\D26E.tmp"109⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"110⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\D30A.tmp"C:\Users\Admin\AppData\Local\Temp\D30A.tmp"111⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\D358.tmp"C:\Users\Admin\AppData\Local\Temp\D358.tmp"112⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\D3A7.tmp"C:\Users\Admin\AppData\Local\Temp\D3A7.tmp"113⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\D3F5.tmp"C:\Users\Admin\AppData\Local\Temp\D3F5.tmp"114⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\D462.tmp"C:\Users\Admin\AppData\Local\Temp\D462.tmp"115⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\D4CF.tmp"C:\Users\Admin\AppData\Local\Temp\D4CF.tmp"116⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\D52D.tmp"C:\Users\Admin\AppData\Local\Temp\D52D.tmp"117⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\D59B.tmp"C:\Users\Admin\AppData\Local\Temp\D59B.tmp"118⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"C:\Users\Admin\AppData\Local\Temp\D5E9.tmp"119⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\D637.tmp"C:\Users\Admin\AppData\Local\Temp\D637.tmp"120⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"121⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\D712.tmp"C:\Users\Admin\AppData\Local\Temp\D712.tmp"122⤵PID:2020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-