Analysis
- max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 21:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-02_fe76f8f7aaa883f7ca67710192bfd670_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-02_fe76f8f7aaa883f7ca67710192bfd670_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-02_fe76f8f7aaa883f7ca67710192bfd670_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample261002-1ctd2swxev
- SHA256 53c996d2e437a2d80a518ca61f67296ae91da17da7f4824f0a0c2947d1273492
- MD5 fe76f8f7aaa883f7ca67710192bfd670
- SHA1 2ec89f4b70102cb968061cb00f3a377bf986c17f
- SHA512 e4096e7659ef02ce457283f985890b592202fdb69a893b98f28910a4f5529f1a020c6c471892d515bfb865626623380165e5f9d0995be3e683e6d83cc285e51b
- SSDEEP 12288:wU5rCOTeiDtO//FuA+gzikRM4glS23jMdelrqc6JZNZ+3/v+I9hUG2VA:wUQOJDtezTRMTE2Iirqc6zNGEA
- TLSH T1AAE4D12173D88536E5FB037859B5E6615D7EFD326722D6CF2B8022AE09B1BC09631723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3624 A738.tmp 1804 A832.tmp 4936 A93B.tmp 4964 AA54.tmp 1836 AB8D.tmp 2164 ACB6.tmp 4348 AD71.tmp 2424 AE9A.tmp 3752 AF94.tmp 2516 B08E.tmp 2080 B198.tmp 3184 B2F0.tmp 116 B418.tmp 3112 B4F3.tmp 4640 B62C.tmp 2376 B745.tmp 3208 B820.tmp 1044 B929.tmp 4048 BA43.tmp 532 BB4C.tmp 1536 BC46.tmp 4360 BD5F.tmp 1720 BE59.tmp 3764 BF73.tmp 4496 C07C.tmp 3636 C186.tmp 4984 C290.tmp 3392 C36A.tmp 4264 C484.tmp 4176 C56E.tmp 4608 C697.tmp 3820 C762.tmp 4520 C82D.tmp 3484 C8AA.tmp 4180 C9D3.tmp 824 CA31.tmp 4052 CABD.tmp 4068 CB69.tmp 3684 CC05.tmp 5064 CCB1.tmp 4940 CD2E.tmp 1560 CDAB.tmp 5012 CE57.tmp 3824 CED4.tmp 1252 CF42.tmp 412 CFCE.tmp 4868 D06A.tmp 3964 D0D8.tmp 4480 D126.tmp 908 D184.tmp 5032 D1D2.tmp 4764 D230.tmp 4540 D27E.tmp 1648 D2CC.tmp 752 D31A.tmp 2488 D378.tmp 816 D3C6.tmp 2040 D414.tmp 1032 D462.tmp 632 D4C0.tmp 3228 D53D.tmp 4636 D58B.tmp 1256 D5D9.tmp 4036 D627.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 699.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D06A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1469.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F989.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C682.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E635.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C48E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 290A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C82D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5058.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F274.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1321.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5143.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C346.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E805.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 773.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2001.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D400.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 253.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5096 wrote to memory of 3624 5096 2026-10-02_fe76f8f7aaa883f7ca67710192bfd670_elex_mafia_stealc_tofsee.exe 87 PID 3624 wrote to memory of 1804 3624 A738.tmp 90 PID 1804 wrote to memory of 4936 1804 A832.tmp 91 PID 4936 wrote to memory of 4964 4936 A93B.tmp 92 PID 4964 wrote to memory of 1836 4964 AA54.tmp 93 PID 1836 wrote to memory of 2164 1836 AB8D.tmp 94 PID 2164 wrote to memory of 4348 2164 ACB6.tmp 95 PID 4348 wrote to memory of 2424 4348 AD71.tmp 96 PID 2424 wrote to memory of 3752 2424 AE9A.tmp 97 PID 3752 wrote to memory of 2516 3752 AF94.tmp 98 PID 2516 wrote to memory of 2080 2516 B08E.tmp 99 PID 2080 wrote to memory of 3184 2080 B198.tmp 102 PID 3184 wrote to memory of 116 3184 B2F0.tmp 103 PID 116 wrote to memory of 3112 116 B418.tmp 104 PID 3112 wrote to memory of 4640 3112 B4F3.tmp 105 PID 4640 wrote to memory of 2376 4640 B62C.tmp 107 PID 2376 wrote to memory of 3208 2376 B745.tmp 108 PID 3208 wrote to memory of 1044 3208 B820.tmp 110 PID 1044 wrote to memory of 4048 1044 B929.tmp 111 PID 4048 wrote to memory of 532 4048 BA43.tmp 112 PID 532 wrote to memory of 1536 532 BB4C.tmp 113 PID 1536 wrote to memory of 4360 1536 BC46.tmp 114 PID 4360 wrote to memory of 1720 4360 BD5F.tmp 115 PID 1720 wrote to memory of 3764 1720 BE59.tmp 116 PID 3764 wrote to memory of 4496 3764 BF73.tmp 117 PID 4496 wrote to memory of 3636 4496 C07C.tmp 118 PID 3636 wrote to memory of 4984 3636 C186.tmp 119 PID 4984 wrote to memory of 3392 4984 C290.tmp 121 PID 3392 wrote to memory of 4264 3392 C36A.tmp 122 PID 4264 wrote to memory of 4176 4264 C484.tmp 123 PID 4176 wrote to memory of 4608 4176 C56E.tmp 124 PID 4608 wrote to memory of 3820 4608 C697.tmp 125 PID 3820 wrote to memory of 4520 3820 C762.tmp 126 PID 4520 wrote to memory of 3484 4520 C82D.tmp 127 PID 2724 wrote to memory of 4180 2724 C946.tmp 129 PID 4180 wrote to memory of 824 4180 C9D3.tmp 130 PID 824 wrote to memory of 4052 824 CA31.tmp 131 PID 4052 wrote to memory of 4068 4052 CABD.tmp 132 PID 4068 wrote to memory of 3684 4068 CB69.tmp 133 PID 3684 wrote to memory of 5064 3684 CC05.tmp 134 PID 5064 wrote to memory of 4940 5064 CCB1.tmp 135 PID 4940 wrote to memory of 1560 4940 CD2E.tmp 136 PID 1560 wrote to memory of 5012 1560 CDAB.tmp 137 PID 5012 wrote to memory of 3824 5012 CE57.tmp 138 PID 3824 wrote to memory of 1252 3824 CED4.tmp 140 PID 1252 wrote to memory of 412 1252 CF42.tmp 141 PID 412 wrote to memory of 4868 412 CFCE.tmp 142 PID 4868 wrote to memory of 3964 4868 D06A.tmp 143 PID 3964 wrote to memory of 4480 3964 D0D8.tmp 144 PID 4480 wrote to memory of 908 4480 D126.tmp 145 PID 908 wrote to memory of 5032 908 D184.tmp 146 PID 5032 wrote to memory of 4764 5032 D1D2.tmp 147 PID 4764 wrote to memory of 4540 4764 D230.tmp 148 PID 4540 wrote to memory of 1648 4540 D27E.tmp 149 PID 1648 wrote to memory of 752 1648 D2CC.tmp 150 PID 752 wrote to memory of 2488 752 D31A.tmp 151 PID 2488 wrote to memory of 816 2488 D378.tmp 152 PID 816 wrote to memory of 2040 816 D3C6.tmp 153 PID 2040 wrote to memory of 1032 2040 D414.tmp 154 PID 1032 wrote to memory of 632 1032 D462.tmp 155 PID 632 wrote to memory of 3228 632 D4C0.tmp 156 PID 3228 wrote to memory of 4636 3228 D53D.tmp 157 PID 4636 wrote to memory of 1256 4636 D58B.tmp 158 PID 1256 wrote to memory of 4036 1256 D5D9.tmp 159
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_fe76f8f7aaa883f7ca67710192bfd670_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_fe76f8f7aaa883f7ca67710192bfd670_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\A738.tmp"C:\Users\Admin\AppData\Local\Temp\A738.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\A832.tmp"C:\Users\Admin\AppData\Local\Temp\A832.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\A93B.tmp"C:\Users\Admin\AppData\Local\Temp\A93B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\AA54.tmp"C:\Users\Admin\AppData\Local\Temp\AA54.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\AB8D.tmp"C:\Users\Admin\AppData\Local\Temp\AB8D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\ACB6.tmp"C:\Users\Admin\AppData\Local\Temp\ACB6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\AD71.tmp"C:\Users\Admin\AppData\Local\Temp\AD71.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\AE9A.tmp"C:\Users\Admin\AppData\Local\Temp\AE9A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\AF94.tmp"C:\Users\Admin\AppData\Local\Temp\AF94.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\B08E.tmp"C:\Users\Admin\AppData\Local\Temp\B08E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\B198.tmp"C:\Users\Admin\AppData\Local\Temp\B198.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\B2F0.tmp"C:\Users\Admin\AppData\Local\Temp\B2F0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\B418.tmp"C:\Users\Admin\AppData\Local\Temp\B418.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\B4F3.tmp"C:\Users\Admin\AppData\Local\Temp\B4F3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\B62C.tmp"C:\Users\Admin\AppData\Local\Temp\B62C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\B745.tmp"C:\Users\Admin\AppData\Local\Temp\B745.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\B820.tmp"C:\Users\Admin\AppData\Local\Temp\B820.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\B929.tmp"C:\Users\Admin\AppData\Local\Temp\B929.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\BA43.tmp"C:\Users\Admin\AppData\Local\Temp\BA43.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\BB4C.tmp"C:\Users\Admin\AppData\Local\Temp\BB4C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\BC46.tmp"C:\Users\Admin\AppData\Local\Temp\BC46.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\BD5F.tmp"C:\Users\Admin\AppData\Local\Temp\BD5F.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\BE59.tmp"C:\Users\Admin\AppData\Local\Temp\BE59.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\BF73.tmp"C:\Users\Admin\AppData\Local\Temp\BF73.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\C07C.tmp"C:\Users\Admin\AppData\Local\Temp\C07C.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\C186.tmp"C:\Users\Admin\AppData\Local\Temp\C186.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\C290.tmp"C:\Users\Admin\AppData\Local\Temp\C290.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\C36A.tmp"C:\Users\Admin\AppData\Local\Temp\C36A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\C484.tmp"C:\Users\Admin\AppData\Local\Temp\C484.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\C56E.tmp"C:\Users\Admin\AppData\Local\Temp\C56E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\C697.tmp"C:\Users\Admin\AppData\Local\Temp\C697.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\C762.tmp"C:\Users\Admin\AppData\Local\Temp\C762.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\C82D.tmp"C:\Users\Admin\AppData\Local\Temp\C82D.tmp"34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\C8AA.tmp"C:\Users\Admin\AppData\Local\Temp\C8AA.tmp"35⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\C946.tmp"C:\Users\Admin\AppData\Local\Temp\C946.tmp"36⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\CA31.tmp"C:\Users\Admin\AppData\Local\Temp\CA31.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\CABD.tmp"C:\Users\Admin\AppData\Local\Temp\CABD.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\CB69.tmp"C:\Users\Admin\AppData\Local\Temp\CB69.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\CC05.tmp"C:\Users\Admin\AppData\Local\Temp\CC05.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\CE57.tmp"C:\Users\Admin\AppData\Local\Temp\CE57.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\CED4.tmp"C:\Users\Admin\AppData\Local\Temp\CED4.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\CF42.tmp"C:\Users\Admin\AppData\Local\Temp\CF42.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\CFCE.tmp"C:\Users\Admin\AppData\Local\Temp\CFCE.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\D06A.tmp"C:\Users\Admin\AppData\Local\Temp\D06A.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\D0D8.tmp"C:\Users\Admin\AppData\Local\Temp\D0D8.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\D126.tmp"C:\Users\Admin\AppData\Local\Temp\D126.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\D184.tmp"C:\Users\Admin\AppData\Local\Temp\D184.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\D1D2.tmp"C:\Users\Admin\AppData\Local\Temp\D1D2.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\D230.tmp"C:\Users\Admin\AppData\Local\Temp\D230.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\D27E.tmp"C:\Users\Admin\AppData\Local\Temp\D27E.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\D2CC.tmp"C:\Users\Admin\AppData\Local\Temp\D2CC.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\D31A.tmp"C:\Users\Admin\AppData\Local\Temp\D31A.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\D378.tmp"C:\Users\Admin\AppData\Local\Temp\D378.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\D3C6.tmp"C:\Users\Admin\AppData\Local\Temp\D3C6.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\D414.tmp"C:\Users\Admin\AppData\Local\Temp\D414.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\D462.tmp"C:\Users\Admin\AppData\Local\Temp\D462.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\D53D.tmp"C:\Users\Admin\AppData\Local\Temp\D53D.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\D58B.tmp"C:\Users\Admin\AppData\Local\Temp\D58B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\D5D9.tmp"C:\Users\Admin\AppData\Local\Temp\D5D9.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\D627.tmp"C:\Users\Admin\AppData\Local\Temp\D627.tmp"66⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\D675.tmp"C:\Users\Admin\AppData\Local\Temp\D675.tmp"67⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"C:\Users\Admin\AppData\Local\Temp\D6D3.tmp"68⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\D721.tmp"C:\Users\Admin\AppData\Local\Temp\D721.tmp"69⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\D76F.tmp"C:\Users\Admin\AppData\Local\Temp\D76F.tmp"70⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\D7BD.tmp"C:\Users\Admin\AppData\Local\Temp\D7BD.tmp"71⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\D80C.tmp"C:\Users\Admin\AppData\Local\Temp\D80C.tmp"72⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\D85A.tmp"C:\Users\Admin\AppData\Local\Temp\D85A.tmp"73⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\D8B7.tmp"C:\Users\Admin\AppData\Local\Temp\D8B7.tmp"74⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\D906.tmp"C:\Users\Admin\AppData\Local\Temp\D906.tmp"75⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\D954.tmp"C:\Users\Admin\AppData\Local\Temp\D954.tmp"76⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\D9B1.tmp"C:\Users\Admin\AppData\Local\Temp\D9B1.tmp"77⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\DA0F.tmp"C:\Users\Admin\AppData\Local\Temp\DA0F.tmp"78⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\DA5D.tmp"C:\Users\Admin\AppData\Local\Temp\DA5D.tmp"79⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\DAAB.tmp"C:\Users\Admin\AppData\Local\Temp\DAAB.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\DAFA.tmp"C:\Users\Admin\AppData\Local\Temp\DAFA.tmp"81⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\DB48.tmp"C:\Users\Admin\AppData\Local\Temp\DB48.tmp"82⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\DB96.tmp"C:\Users\Admin\AppData\Local\Temp\DB96.tmp"83⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\DBE4.tmp"C:\Users\Admin\AppData\Local\Temp\DBE4.tmp"84⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\DC42.tmp"C:\Users\Admin\AppData\Local\Temp\DC42.tmp"85⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\DC90.tmp"C:\Users\Admin\AppData\Local\Temp\DC90.tmp"86⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\DCDE.tmp"C:\Users\Admin\AppData\Local\Temp\DCDE.tmp"87⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"88⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"89⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\DDC8.tmp"C:\Users\Admin\AppData\Local\Temp\DDC8.tmp"90⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\DE16.tmp"C:\Users\Admin\AppData\Local\Temp\DE16.tmp"91⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\DE65.tmp"C:\Users\Admin\AppData\Local\Temp\DE65.tmp"92⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\DEB3.tmp"C:\Users\Admin\AppData\Local\Temp\DEB3.tmp"93⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\DF01.tmp"C:\Users\Admin\AppData\Local\Temp\DF01.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\DF5F.tmp"C:\Users\Admin\AppData\Local\Temp\DF5F.tmp"95⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\DFBC.tmp"C:\Users\Admin\AppData\Local\Temp\DFBC.tmp"96⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\E00A.tmp"C:\Users\Admin\AppData\Local\Temp\E00A.tmp"97⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\E059.tmp"C:\Users\Admin\AppData\Local\Temp\E059.tmp"98⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\E0A7.tmp"C:\Users\Admin\AppData\Local\Temp\E0A7.tmp"99⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\E0F5.tmp"C:\Users\Admin\AppData\Local\Temp\E0F5.tmp"100⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\E153.tmp"C:\Users\Admin\AppData\Local\Temp\E153.tmp"101⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\E1A1.tmp"C:\Users\Admin\AppData\Local\Temp\E1A1.tmp"102⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\E1FE.tmp"C:\Users\Admin\AppData\Local\Temp\E1FE.tmp"103⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\E25C.tmp"C:\Users\Admin\AppData\Local\Temp\E25C.tmp"104⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\E2AA.tmp"C:\Users\Admin\AppData\Local\Temp\E2AA.tmp"105⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\E2F8.tmp"C:\Users\Admin\AppData\Local\Temp\E2F8.tmp"106⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\E347.tmp"C:\Users\Admin\AppData\Local\Temp\E347.tmp"107⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\E395.tmp"C:\Users\Admin\AppData\Local\Temp\E395.tmp"108⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\E3E3.tmp"C:\Users\Admin\AppData\Local\Temp\E3E3.tmp"109⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\E431.tmp"C:\Users\Admin\AppData\Local\Temp\E431.tmp"110⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\E47F.tmp"C:\Users\Admin\AppData\Local\Temp\E47F.tmp"111⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"112⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\E53B.tmp"C:\Users\Admin\AppData\Local\Temp\E53B.tmp"113⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\E598.tmp"C:\Users\Admin\AppData\Local\Temp\E598.tmp"114⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"C:\Users\Admin\AppData\Local\Temp\E5E6.tmp"115⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\E635.tmp"C:\Users\Admin\AppData\Local\Temp\E635.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:972 -
C:\Users\Admin\AppData\Local\Temp\E692.tmp"C:\Users\Admin\AppData\Local\Temp\E692.tmp"117⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\E6E0.tmp"C:\Users\Admin\AppData\Local\Temp\E6E0.tmp"118⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\E72F.tmp"C:\Users\Admin\AppData\Local\Temp\E72F.tmp"119⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\E77D.tmp"C:\Users\Admin\AppData\Local\Temp\E77D.tmp"120⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"121⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\E829.tmp"C:\Users\Admin\AppData\Local\Temp\E829.tmp"122⤵PID:1428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-