Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 17:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-29_bd614beafd117010bf444b4e91e0bcd0_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_bd614beafd117010bf444b4e91e0bcd0_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-29_bd614beafd117010bf444b4e91e0bcd0_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260930-vjaydsshlh
- SHA256 21b034a44aa6937012420362e05ebdaa4e39c49968d2c919cc7fea55ed7e030e
- MD5 bd614beafd117010bf444b4e91e0bcd0
- SHA1 16955e906e91952a2ad60b65e0cfd44c52f5592e
- SHA512 e133f192fc650c306563e2075bea9380343278a82156d4e05ed78332cf34f08ec9dde1d17719aac910364749944da20f873c36ab004e51f51f62c59ac2e0fa92
- SSDEEP 12288:NU5rCOTeijybQqCenOiydS/dYdQodCSWYiCQQkyDTZwlH4Hp:NUQOJj7lGlR/du5CSBkUTSlH4Hp
- TLSH T1FCB4F026B644C133E2D202710AE6DBA22A3FBC75572590C72B94A27E2FB57E1D375343
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2328 C57E.tmp 5448 C639.tmp 5300 C6D5.tmp 1484 C723.tmp 1756 C781.tmp 732 C7DF.tmp 4920 C84C.tmp 5748 C8D9.tmp 5440 C927.tmp 3456 C975.tmp 4604 C9D3.tmp 5200 CA21.tmp 1736 CA7F.tmp 4040 CADD.tmp 2520 CB3A.tmp 1888 CB88.tmp 3464 CBF6.tmp 2860 CC44.tmp 6068 CC92.tmp 2692 CCE0.tmp 5888 CD4E.tmp 6072 CDBB.tmp 1928 CE09.tmp 3004 CE57.tmp 888 CEA5.tmp 5268 CF03.tmp 3960 CF51.tmp 5024 CF9F.tmp 5296 CFED.tmp 3220 D05B.tmp 4028 D0C8.tmp 1744 D116.tmp 5628 D164.tmp 2276 D1B3.tmp 5068 D201.tmp 1384 D24F.tmp 3864 D29D.tmp 1864 D2EB.tmp 2728 D339.tmp 4392 D387.tmp 3260 D3D5.tmp 3880 D424.tmp 3824 D472.tmp 4120 D4C0.tmp 3920 D50E.tmp 4024 D55C.tmp 3648 D5BA.tmp 4832 D608.tmp 4956 D656.tmp 2056 D6A4.tmp 5140 D6F2.tmp 4460 D740.tmp 4432 D78F.tmp 804 D7DD.tmp 392 D82B.tmp 1460 D879.tmp 1700 D8C7.tmp 2312 D915.tmp 5952 D963.tmp 1240 D9B1.tmp 6004 DA00.tmp 2500 DA4E.tmp 5536 DA9C.tmp 4004 DAEA.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8284.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5431.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 138E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B04B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 280B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C51B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D298.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D97E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2608.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 479E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 716D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E683.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 377C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 290A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFAF.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4572 wrote to memory of 2328 4572 2026-09-29_bd614beafd117010bf444b4e91e0bcd0_elex_mafia_stealc_tofsee.exe 85 PID 2328 wrote to memory of 5448 2328 C57E.tmp 86 PID 5448 wrote to memory of 5300 5448 C639.tmp 87 PID 5300 wrote to memory of 1484 5300 C6D5.tmp 90 PID 1484 wrote to memory of 1756 1484 C723.tmp 91 PID 1756 wrote to memory of 732 1756 C781.tmp 93 PID 732 wrote to memory of 4920 732 C7DF.tmp 94 PID 4920 wrote to memory of 5748 4920 C84C.tmp 95 PID 5748 wrote to memory of 5440 5748 C8D9.tmp 96 PID 5440 wrote to memory of 3456 5440 C927.tmp 97 PID 3456 wrote to memory of 4604 3456 C975.tmp 98 PID 4604 wrote to memory of 5200 4604 C9D3.tmp 99 PID 5200 wrote to memory of 1736 5200 CA21.tmp 100 PID 1736 wrote to memory of 4040 1736 CA7F.tmp 101 PID 4040 wrote to memory of 2520 4040 CADD.tmp 102 PID 2520 wrote to memory of 1888 2520 CB3A.tmp 103 PID 1888 wrote to memory of 3464 1888 CB88.tmp 104 PID 3464 wrote to memory of 2860 3464 CBF6.tmp 105 PID 2860 wrote to memory of 6068 2860 CC44.tmp 106 PID 6068 wrote to memory of 2692 6068 CC92.tmp 107 PID 2692 wrote to memory of 5888 2692 CCE0.tmp 108 PID 5888 wrote to memory of 6072 5888 CD4E.tmp 109 PID 6072 wrote to memory of 1928 6072 CDBB.tmp 110 PID 1928 wrote to memory of 3004 1928 CE09.tmp 111 PID 3004 wrote to memory of 888 3004 CE57.tmp 112 PID 888 wrote to memory of 5268 888 CEA5.tmp 113 PID 5268 wrote to memory of 3960 5268 CF03.tmp 116 PID 3960 wrote to memory of 5024 3960 CF51.tmp 117 PID 5024 wrote to memory of 5296 5024 CF9F.tmp 118 PID 5296 wrote to memory of 3220 5296 CFED.tmp 119 PID 3220 wrote to memory of 4028 3220 D05B.tmp 120 PID 4028 wrote to memory of 1744 4028 D0C8.tmp 121 PID 1744 wrote to memory of 5628 1744 D116.tmp 122 PID 5628 wrote to memory of 2276 5628 D164.tmp 123 PID 2276 wrote to memory of 5068 2276 D1B3.tmp 124 PID 5068 wrote to memory of 1384 5068 D201.tmp 125 PID 1384 wrote to memory of 3864 1384 D24F.tmp 126 PID 3864 wrote to memory of 1864 3864 D29D.tmp 127 PID 1864 wrote to memory of 2728 1864 D2EB.tmp 129 PID 2728 wrote to memory of 4392 2728 D339.tmp 130 PID 4392 wrote to memory of 3260 4392 D387.tmp 132 PID 3260 wrote to memory of 3880 3260 D3D5.tmp 133 PID 3880 wrote to memory of 3824 3880 D424.tmp 134 PID 3824 wrote to memory of 4120 3824 D472.tmp 135 PID 4120 wrote to memory of 3920 4120 D4C0.tmp 136 PID 3920 wrote to memory of 4024 3920 D50E.tmp 137 PID 4024 wrote to memory of 3648 4024 D55C.tmp 138 PID 3648 wrote to memory of 4832 3648 D5BA.tmp 139 PID 4832 wrote to memory of 4956 4832 D608.tmp 140 PID 4956 wrote to memory of 2056 4956 D656.tmp 141 PID 2056 wrote to memory of 5140 2056 D6A4.tmp 142 PID 5140 wrote to memory of 4460 5140 D6F2.tmp 143 PID 4460 wrote to memory of 4432 4460 D740.tmp 144 PID 4432 wrote to memory of 804 4432 D78F.tmp 146 PID 804 wrote to memory of 392 804 D7DD.tmp 147 PID 392 wrote to memory of 1460 392 D82B.tmp 148 PID 1460 wrote to memory of 1700 1460 D879.tmp 149 PID 1700 wrote to memory of 2312 1700 D8C7.tmp 150 PID 2312 wrote to memory of 5952 2312 D915.tmp 151 PID 5952 wrote to memory of 1240 5952 D963.tmp 152 PID 1240 wrote to memory of 6004 1240 D9B1.tmp 153 PID 6004 wrote to memory of 2500 6004 DA00.tmp 154 PID 2500 wrote to memory of 5536 2500 DA4E.tmp 155 PID 5536 wrote to memory of 4004 5536 DA9C.tmp 156
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_bd614beafd117010bf444b4e91e0bcd0_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_bd614beafd117010bf444b4e91e0bcd0_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\C57E.tmp"C:\Users\Admin\AppData\Local\Temp\C57E.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\C639.tmp"C:\Users\Admin\AppData\Local\Temp\C639.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\C6D5.tmp"C:\Users\Admin\AppData\Local\Temp\C6D5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\C723.tmp"C:\Users\Admin\AppData\Local\Temp\C723.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\C781.tmp"C:\Users\Admin\AppData\Local\Temp\C781.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\C7DF.tmp"C:\Users\Admin\AppData\Local\Temp\C7DF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\C84C.tmp"C:\Users\Admin\AppData\Local\Temp\C84C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\C8D9.tmp"C:\Users\Admin\AppData\Local\Temp\C8D9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5748 -
C:\Users\Admin\AppData\Local\Temp\C927.tmp"C:\Users\Admin\AppData\Local\Temp\C927.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\C975.tmp"C:\Users\Admin\AppData\Local\Temp\C975.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\CA21.tmp"C:\Users\Admin\AppData\Local\Temp\CA21.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5200 -
C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"C:\Users\Admin\AppData\Local\Temp\CA7F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\CADD.tmp"C:\Users\Admin\AppData\Local\Temp\CADD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\CB88.tmp"C:\Users\Admin\AppData\Local\Temp\CB88.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\CC44.tmp"C:\Users\Admin\AppData\Local\Temp\CC44.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\CC92.tmp"C:\Users\Admin\AppData\Local\Temp\CC92.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6068 -
C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\CD4E.tmp"C:\Users\Admin\AppData\Local\Temp\CD4E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\CE57.tmp"C:\Users\Admin\AppData\Local\Temp\CE57.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\CF03.tmp"C:\Users\Admin\AppData\Local\Temp\CF03.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\CF51.tmp"C:\Users\Admin\AppData\Local\Temp\CF51.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\CF9F.tmp"C:\Users\Admin\AppData\Local\Temp\CF9F.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\CFED.tmp"C:\Users\Admin\AppData\Local\Temp\CFED.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5296 -
C:\Users\Admin\AppData\Local\Temp\D05B.tmp"C:\Users\Admin\AppData\Local\Temp\D05B.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\D0C8.tmp"C:\Users\Admin\AppData\Local\Temp\D0C8.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\D116.tmp"C:\Users\Admin\AppData\Local\Temp\D116.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\D164.tmp"C:\Users\Admin\AppData\Local\Temp\D164.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Users\Admin\AppData\Local\Temp\D1B3.tmp"C:\Users\Admin\AppData\Local\Temp\D1B3.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\D201.tmp"C:\Users\Admin\AppData\Local\Temp\D201.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\D24F.tmp"C:\Users\Admin\AppData\Local\Temp\D24F.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\D29D.tmp"C:\Users\Admin\AppData\Local\Temp\D29D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\D2EB.tmp"C:\Users\Admin\AppData\Local\Temp\D2EB.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\D339.tmp"C:\Users\Admin\AppData\Local\Temp\D339.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\D387.tmp"C:\Users\Admin\AppData\Local\Temp\D387.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\D424.tmp"C:\Users\Admin\AppData\Local\Temp\D424.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\D472.tmp"C:\Users\Admin\AppData\Local\Temp\D472.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\D50E.tmp"C:\Users\Admin\AppData\Local\Temp\D50E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\D55C.tmp"C:\Users\Admin\AppData\Local\Temp\D55C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\D5BA.tmp"C:\Users\Admin\AppData\Local\Temp\D5BA.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\D608.tmp"C:\Users\Admin\AppData\Local\Temp\D608.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\D656.tmp"C:\Users\Admin\AppData\Local\Temp\D656.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"C:\Users\Admin\AppData\Local\Temp\D6A4.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\D6F2.tmp"C:\Users\Admin\AppData\Local\Temp\D6F2.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\D740.tmp"C:\Users\Admin\AppData\Local\Temp\D740.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\D78F.tmp"C:\Users\Admin\AppData\Local\Temp\D78F.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\D82B.tmp"C:\Users\Admin\AppData\Local\Temp\D82B.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\D879.tmp"C:\Users\Admin\AppData\Local\Temp\D879.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\D8C7.tmp"C:\Users\Admin\AppData\Local\Temp\D8C7.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\D915.tmp"C:\Users\Admin\AppData\Local\Temp\D915.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\D963.tmp"C:\Users\Admin\AppData\Local\Temp\D963.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\D9B1.tmp"C:\Users\Admin\AppData\Local\Temp\D9B1.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\DA00.tmp"C:\Users\Admin\AppData\Local\Temp\DA00.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\DA4E.tmp"C:\Users\Admin\AppData\Local\Temp\DA4E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\DA9C.tmp"C:\Users\Admin\AppData\Local\Temp\DA9C.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"C:\Users\Admin\AppData\Local\Temp\DAEA.tmp"65⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\DB38.tmp"C:\Users\Admin\AppData\Local\Temp\DB38.tmp"66⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\DB86.tmp"C:\Users\Admin\AppData\Local\Temp\DB86.tmp"67⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\DBD4.tmp"C:\Users\Admin\AppData\Local\Temp\DBD4.tmp"68⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\DC22.tmp"C:\Users\Admin\AppData\Local\Temp\DC22.tmp"69⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\DC71.tmp"C:\Users\Admin\AppData\Local\Temp\DC71.tmp"70⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\DCBF.tmp"C:\Users\Admin\AppData\Local\Temp\DCBF.tmp"71⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\DD0D.tmp"C:\Users\Admin\AppData\Local\Temp\DD0D.tmp"72⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\DD5B.tmp"C:\Users\Admin\AppData\Local\Temp\DD5B.tmp"73⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\DDA9.tmp"C:\Users\Admin\AppData\Local\Temp\DDA9.tmp"74⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\DDF7.tmp"C:\Users\Admin\AppData\Local\Temp\DDF7.tmp"75⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\DE45.tmp"C:\Users\Admin\AppData\Local\Temp\DE45.tmp"76⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\DE93.tmp"C:\Users\Admin\AppData\Local\Temp\DE93.tmp"77⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\DEE2.tmp"C:\Users\Admin\AppData\Local\Temp\DEE2.tmp"78⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\DF30.tmp"C:\Users\Admin\AppData\Local\Temp\DF30.tmp"79⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\DF7E.tmp"C:\Users\Admin\AppData\Local\Temp\DF7E.tmp"80⤵PID:5832
-
C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"C:\Users\Admin\AppData\Local\Temp\DFCC.tmp"81⤵PID:5384
-
C:\Users\Admin\AppData\Local\Temp\E01A.tmp"C:\Users\Admin\AppData\Local\Temp\E01A.tmp"82⤵PID:5248
-
C:\Users\Admin\AppData\Local\Temp\E068.tmp"C:\Users\Admin\AppData\Local\Temp\E068.tmp"83⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\E0B6.tmp"C:\Users\Admin\AppData\Local\Temp\E0B6.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\E104.tmp"C:\Users\Admin\AppData\Local\Temp\E104.tmp"85⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\E153.tmp"C:\Users\Admin\AppData\Local\Temp\E153.tmp"86⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\E1C0.tmp"C:\Users\Admin\AppData\Local\Temp\E1C0.tmp"87⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\E20E.tmp"C:\Users\Admin\AppData\Local\Temp\E20E.tmp"88⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\E26C.tmp"C:\Users\Admin\AppData\Local\Temp\E26C.tmp"89⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\E2F8.tmp"C:\Users\Admin\AppData\Local\Temp\E2F8.tmp"90⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\E347.tmp"C:\Users\Admin\AppData\Local\Temp\E347.tmp"91⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\E3D3.tmp"C:\Users\Admin\AppData\Local\Temp\E3D3.tmp"92⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\E450.tmp"C:\Users\Admin\AppData\Local\Temp\E450.tmp"93⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\E4CD.tmp"C:\Users\Admin\AppData\Local\Temp\E4CD.tmp"94⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\E51B.tmp"C:\Users\Admin\AppData\Local\Temp\E51B.tmp"95⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\E569.tmp"C:\Users\Admin\AppData\Local\Temp\E569.tmp"96⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\E5B8.tmp"C:\Users\Admin\AppData\Local\Temp\E5B8.tmp"97⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\E625.tmp"C:\Users\Admin\AppData\Local\Temp\E625.tmp"98⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\E683.tmp"C:\Users\Admin\AppData\Local\Temp\E683.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\E6E0.tmp"C:\Users\Admin\AppData\Local\Temp\E6E0.tmp"100⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\E73E.tmp"C:\Users\Admin\AppData\Local\Temp\E73E.tmp"101⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\E78C.tmp"C:\Users\Admin\AppData\Local\Temp\E78C.tmp"102⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\E7EA.tmp"C:\Users\Admin\AppData\Local\Temp\E7EA.tmp"103⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\E867.tmp"C:\Users\Admin\AppData\Local\Temp\E867.tmp"104⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\E8C5.tmp"C:\Users\Admin\AppData\Local\Temp\E8C5.tmp"105⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\E932.tmp"C:\Users\Admin\AppData\Local\Temp\E932.tmp"106⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\E9BF.tmp"C:\Users\Admin\AppData\Local\Temp\E9BF.tmp"107⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\EA5B.tmp"C:\Users\Admin\AppData\Local\Temp\EA5B.tmp"108⤵PID:5220
-
C:\Users\Admin\AppData\Local\Temp\EAB9.tmp"C:\Users\Admin\AppData\Local\Temp\EAB9.tmp"109⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\EB07.tmp"C:\Users\Admin\AppData\Local\Temp\EB07.tmp"110⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\EB55.tmp"C:\Users\Admin\AppData\Local\Temp\EB55.tmp"111⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\EBA3.tmp"C:\Users\Admin\AppData\Local\Temp\EBA3.tmp"112⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\EC20.tmp"C:\Users\Admin\AppData\Local\Temp\EC20.tmp"113⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"114⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\ECBC.tmp"C:\Users\Admin\AppData\Local\Temp\ECBC.tmp"115⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\ED1A.tmp"C:\Users\Admin\AppData\Local\Temp\ED1A.tmp"116⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\ED68.tmp"C:\Users\Admin\AppData\Local\Temp\ED68.tmp"117⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\EDB6.tmp"C:\Users\Admin\AppData\Local\Temp\EDB6.tmp"118⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\EE05.tmp"C:\Users\Admin\AppData\Local\Temp\EE05.tmp"119⤵
- System Location Discovery: System Language Discovery
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\EE53.tmp"C:\Users\Admin\AppData\Local\Temp\EE53.tmp"120⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\EEA1.tmp"C:\Users\Admin\AppData\Local\Temp\EEA1.tmp"121⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\EEFF.tmp"C:\Users\Admin\AppData\Local\Temp\EEFF.tmp"122⤵PID:5976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-