Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/10/2026, 10:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-02_709b20de68de6d40deecd97fb571022d_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-02_709b20de68de6d40deecd97fb571022d_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-02_709b20de68de6d40deecd97fb571022d_elex_mafia_stealc_tofsee.exe
- Size 541KB
- Sample261003-mfnfbawerc
- SHA256 2cc90e5624a1e7b7353d39ba3f9eb1d15f5e3e8b95d8d1acbfefda4172bb6c4a
- MD5 709b20de68de6d40deecd97fb571022d
- SHA1 01aeee35c0059e661d7e404b5a7a8d20a3868ba2
- SHA512 761026651c03833f5f37356ecf9a25111a19d4f6ef00c8f45a12eb9fffab5327658d0d7003defb8d3b0c661ee7033c4d007bd8fd4d017790927064a4b7cfddad
- SSDEEP 12288:HU5rCOTeiJciAqdMgMCOCkt06MOTAscXl0dNZb73ctO:HUQOJJjKdCpOTQMNV73ctO
- TLSH T168C4F125B544C133D6C202310ADAEBF2AA3A7D76572694C37BD4A23E2F716D0E375346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4164 B4F3.tmp 4968 B59F.tmp 5024 B689.tmp 4864 B745.tmp 2200 B7F1.tmp 3320 B88D.tmp 5116 B8FA.tmp 4484 B997.tmp 3476 BA43.tmp 852 BAEE.tmp 1848 BBAA.tmp 1968 BC37.tmp 2400 BD11.tmp 4300 BDCD.tmp 4732 BE4A.tmp 784 BEF6.tmp 452 BFC1.tmp 4016 C06D.tmp 3380 C109.tmp 988 C176.tmp 3944 C203.tmp 380 C280.tmp 1056 C2ED.tmp 2696 C3A9.tmp 3920 C407.tmp 3916 C4C2.tmp 1020 C55E.tmp 3100 C5EB.tmp 2892 C678.tmp 3316 C723.tmp 1472 C81D.tmp 4740 CAEC.tmp 4304 CB98.tmp 4576 CBE6.tmp 4512 CC44.tmp 3688 CCA2.tmp 2916 CCFF.tmp 4972 CD6D.tmp 1040 CDBB.tmp 2112 CE09.tmp 1804 CE57.tmp 3804 CF22.tmp 2252 CF70.tmp 4688 CFBF.tmp 2452 D01C.tmp 3432 D06A.tmp 212 D0B9.tmp 3144 D107.tmp 2372 D155.tmp 2072 D1A3.tmp 5032 D201.tmp 616 D24F.tmp 1588 D29D.tmp 3704 D2EB.tmp 3624 D339.tmp 1824 D387.tmp 4852 D3D5.tmp 4600 D424.tmp 3572 D472.tmp 708 D4C0.tmp 1852 D51E.tmp 1284 D56C.tmp 1468 D5C9.tmp 3608 D618.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2699.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2210.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B54C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D424.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6632.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C402.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E29B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F037.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1752.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D29D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDA9.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1884 wrote to memory of 4164 1884 2026-10-02_709b20de68de6d40deecd97fb571022d_elex_mafia_stealc_tofsee.exe 86 PID 4164 wrote to memory of 4968 4164 B4F3.tmp 87 PID 4968 wrote to memory of 5024 4968 B59F.tmp 89 PID 5024 wrote to memory of 4864 5024 B689.tmp 90 PID 4864 wrote to memory of 2200 4864 B745.tmp 92 PID 2200 wrote to memory of 3320 2200 B7F1.tmp 94 PID 3320 wrote to memory of 5116 3320 B88D.tmp 95 PID 5116 wrote to memory of 4484 5116 B8FA.tmp 96 PID 4484 wrote to memory of 3476 4484 B997.tmp 97 PID 3476 wrote to memory of 852 3476 BA43.tmp 98 PID 852 wrote to memory of 1848 852 BAEE.tmp 99 PID 1848 wrote to memory of 1968 1848 BBAA.tmp 100 PID 1968 wrote to memory of 2400 1968 BC37.tmp 101 PID 2400 wrote to memory of 4300 2400 BD11.tmp 102 PID 4300 wrote to memory of 4732 4300 BDCD.tmp 103 PID 4732 wrote to memory of 784 4732 BE4A.tmp 104 PID 784 wrote to memory of 452 784 BEF6.tmp 105 PID 452 wrote to memory of 4016 452 BFC1.tmp 107 PID 4016 wrote to memory of 3380 4016 C06D.tmp 108 PID 3380 wrote to memory of 988 3380 C109.tmp 109 PID 988 wrote to memory of 3944 988 C176.tmp 110 PID 3944 wrote to memory of 380 3944 C203.tmp 113 PID 380 wrote to memory of 1056 380 C280.tmp 114 PID 1056 wrote to memory of 2696 1056 C2ED.tmp 116 PID 2696 wrote to memory of 3920 2696 C3A9.tmp 117 PID 3920 wrote to memory of 3916 3920 C407.tmp 118 PID 3916 wrote to memory of 1020 3916 C4C2.tmp 119 PID 1020 wrote to memory of 3100 1020 C55E.tmp 120 PID 3100 wrote to memory of 2892 3100 C5EB.tmp 121 PID 2892 wrote to memory of 3316 2892 C678.tmp 123 PID 3316 wrote to memory of 1472 3316 C723.tmp 125 PID 1472 wrote to memory of 4740 1472 C81D.tmp 126 PID 4740 wrote to memory of 4304 4740 CAEC.tmp 127 PID 4304 wrote to memory of 4576 4304 CB98.tmp 128 PID 4576 wrote to memory of 4512 4576 CBE6.tmp 129 PID 4512 wrote to memory of 3688 4512 CC44.tmp 130 PID 3688 wrote to memory of 2916 3688 CCA2.tmp 131 PID 2916 wrote to memory of 4972 2916 CCFF.tmp 132 PID 4972 wrote to memory of 1040 4972 CD6D.tmp 133 PID 1040 wrote to memory of 2112 1040 CDBB.tmp 134 PID 2112 wrote to memory of 1804 2112 CE09.tmp 135 PID 1804 wrote to memory of 3804 1804 CE57.tmp 136 PID 3804 wrote to memory of 2252 3804 CF22.tmp 137 PID 2252 wrote to memory of 4688 2252 CF70.tmp 139 PID 4688 wrote to memory of 2452 4688 CFBF.tmp 140 PID 2452 wrote to memory of 3432 2452 D01C.tmp 141 PID 3432 wrote to memory of 212 3432 D06A.tmp 143 PID 212 wrote to memory of 3144 212 D0B9.tmp 144 PID 3144 wrote to memory of 2372 3144 D107.tmp 145 PID 2372 wrote to memory of 2072 2372 D155.tmp 146 PID 2072 wrote to memory of 5032 2072 D1A3.tmp 147 PID 5032 wrote to memory of 616 5032 D201.tmp 149 PID 616 wrote to memory of 1588 616 D24F.tmp 150 PID 1588 wrote to memory of 3704 1588 D29D.tmp 152 PID 3704 wrote to memory of 3624 3704 D2EB.tmp 153 PID 3624 wrote to memory of 1824 3624 D339.tmp 154 PID 1824 wrote to memory of 4852 1824 D387.tmp 155 PID 4852 wrote to memory of 4600 4852 D3D5.tmp 156 PID 4600 wrote to memory of 3572 4600 D424.tmp 157 PID 3572 wrote to memory of 708 3572 D472.tmp 158 PID 708 wrote to memory of 1852 708 D4C0.tmp 159 PID 1852 wrote to memory of 1284 1852 D51E.tmp 160 PID 1284 wrote to memory of 1468 1284 D56C.tmp 161 PID 1468 wrote to memory of 3608 1468 D5C9.tmp 162
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_709b20de68de6d40deecd97fb571022d_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_709b20de68de6d40deecd97fb571022d_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\B4F3.tmp"C:\Users\Admin\AppData\Local\Temp\B4F3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\B59F.tmp"C:\Users\Admin\AppData\Local\Temp\B59F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\B689.tmp"C:\Users\Admin\AppData\Local\Temp\B689.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\B745.tmp"C:\Users\Admin\AppData\Local\Temp\B745.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\B7F1.tmp"C:\Users\Admin\AppData\Local\Temp\B7F1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\B88D.tmp"C:\Users\Admin\AppData\Local\Temp\B88D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\B997.tmp"C:\Users\Admin\AppData\Local\Temp\B997.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\BA43.tmp"C:\Users\Admin\AppData\Local\Temp\BA43.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\BAEE.tmp"C:\Users\Admin\AppData\Local\Temp\BAEE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\BBAA.tmp"C:\Users\Admin\AppData\Local\Temp\BBAA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\BC37.tmp"C:\Users\Admin\AppData\Local\Temp\BC37.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\BD11.tmp"C:\Users\Admin\AppData\Local\Temp\BD11.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\BDCD.tmp"C:\Users\Admin\AppData\Local\Temp\BDCD.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\BE4A.tmp"C:\Users\Admin\AppData\Local\Temp\BE4A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\BEF6.tmp"C:\Users\Admin\AppData\Local\Temp\BEF6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\BFC1.tmp"C:\Users\Admin\AppData\Local\Temp\BFC1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\C06D.tmp"C:\Users\Admin\AppData\Local\Temp\C06D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\C109.tmp"C:\Users\Admin\AppData\Local\Temp\C109.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\C176.tmp"C:\Users\Admin\AppData\Local\Temp\C176.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\C203.tmp"C:\Users\Admin\AppData\Local\Temp\C203.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\C280.tmp"C:\Users\Admin\AppData\Local\Temp\C280.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\C2ED.tmp"C:\Users\Admin\AppData\Local\Temp\C2ED.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\C3A9.tmp"C:\Users\Admin\AppData\Local\Temp\C3A9.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\C407.tmp"C:\Users\Admin\AppData\Local\Temp\C407.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\C4C2.tmp"C:\Users\Admin\AppData\Local\Temp\C4C2.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\C55E.tmp"C:\Users\Admin\AppData\Local\Temp\C55E.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\C5EB.tmp"C:\Users\Admin\AppData\Local\Temp\C5EB.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\C678.tmp"C:\Users\Admin\AppData\Local\Temp\C678.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\C723.tmp"C:\Users\Admin\AppData\Local\Temp\C723.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\C81D.tmp"C:\Users\Admin\AppData\Local\Temp\C81D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\CAEC.tmp"C:\Users\Admin\AppData\Local\Temp\CAEC.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\CB98.tmp"C:\Users\Admin\AppData\Local\Temp\CB98.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\CC44.tmp"C:\Users\Admin\AppData\Local\Temp\CC44.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\CD6D.tmp"C:\Users\Admin\AppData\Local\Temp\CD6D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\CE57.tmp"C:\Users\Admin\AppData\Local\Temp\CE57.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\CF22.tmp"C:\Users\Admin\AppData\Local\Temp\CF22.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\CF70.tmp"C:\Users\Admin\AppData\Local\Temp\CF70.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\D01C.tmp"C:\Users\Admin\AppData\Local\Temp\D01C.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\D06A.tmp"C:\Users\Admin\AppData\Local\Temp\D06A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\D0B9.tmp"C:\Users\Admin\AppData\Local\Temp\D0B9.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\D107.tmp"C:\Users\Admin\AppData\Local\Temp\D107.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\D155.tmp"C:\Users\Admin\AppData\Local\Temp\D155.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\D1A3.tmp"C:\Users\Admin\AppData\Local\Temp\D1A3.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\D201.tmp"C:\Users\Admin\AppData\Local\Temp\D201.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\D24F.tmp"C:\Users\Admin\AppData\Local\Temp\D24F.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Users\Admin\AppData\Local\Temp\D29D.tmp"C:\Users\Admin\AppData\Local\Temp\D29D.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\D2EB.tmp"C:\Users\Admin\AppData\Local\Temp\D2EB.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\D339.tmp"C:\Users\Admin\AppData\Local\Temp\D339.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\D387.tmp"C:\Users\Admin\AppData\Local\Temp\D387.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\D424.tmp"C:\Users\Admin\AppData\Local\Temp\D424.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\D472.tmp"C:\Users\Admin\AppData\Local\Temp\D472.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\D51E.tmp"C:\Users\Admin\AppData\Local\Temp\D51E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\D56C.tmp"C:\Users\Admin\AppData\Local\Temp\D56C.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\D5C9.tmp"C:\Users\Admin\AppData\Local\Temp\D5C9.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\D618.tmp"C:\Users\Admin\AppData\Local\Temp\D618.tmp"65⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\D675.tmp"C:\Users\Admin\AppData\Local\Temp\D675.tmp"66⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\D6C3.tmp"C:\Users\Admin\AppData\Local\Temp\D6C3.tmp"67⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\D721.tmp"C:\Users\Admin\AppData\Local\Temp\D721.tmp"68⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\D76F.tmp"C:\Users\Admin\AppData\Local\Temp\D76F.tmp"69⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\D7BD.tmp"C:\Users\Admin\AppData\Local\Temp\D7BD.tmp"70⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\D80C.tmp"C:\Users\Admin\AppData\Local\Temp\D80C.tmp"71⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\D889.tmp"C:\Users\Admin\AppData\Local\Temp\D889.tmp"72⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\D8D7.tmp"C:\Users\Admin\AppData\Local\Temp\D8D7.tmp"73⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\D934.tmp"C:\Users\Admin\AppData\Local\Temp\D934.tmp"74⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\D992.tmp"C:\Users\Admin\AppData\Local\Temp\D992.tmp"75⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\DA00.tmp"C:\Users\Admin\AppData\Local\Temp\DA00.tmp"76⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\DABB.tmp"C:\Users\Admin\AppData\Local\Temp\DABB.tmp"77⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\DB67.tmp"C:\Users\Admin\AppData\Local\Temp\DB67.tmp"78⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\DBD4.tmp"C:\Users\Admin\AppData\Local\Temp\DBD4.tmp"79⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\DC51.tmp"C:\Users\Admin\AppData\Local\Temp\DC51.tmp"80⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\DC9F.tmp"C:\Users\Admin\AppData\Local\Temp\DC9F.tmp"81⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\DD0D.tmp"C:\Users\Admin\AppData\Local\Temp\DD0D.tmp"82⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\DD5B.tmp"C:\Users\Admin\AppData\Local\Temp\DD5B.tmp"83⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\DDA9.tmp"C:\Users\Admin\AppData\Local\Temp\DDA9.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\DE07.tmp"C:\Users\Admin\AppData\Local\Temp\DE07.tmp"85⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\DE55.tmp"C:\Users\Admin\AppData\Local\Temp\DE55.tmp"86⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\DEA3.tmp"C:\Users\Admin\AppData\Local\Temp\DEA3.tmp"87⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\DEF1.tmp"C:\Users\Admin\AppData\Local\Temp\DEF1.tmp"88⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\DF3F.tmp"C:\Users\Admin\AppData\Local\Temp\DF3F.tmp"89⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\DF9D.tmp"C:\Users\Admin\AppData\Local\Temp\DF9D.tmp"90⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\DFEB.tmp"C:\Users\Admin\AppData\Local\Temp\DFEB.tmp"91⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\E039.tmp"C:\Users\Admin\AppData\Local\Temp\E039.tmp"92⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\E087.tmp"C:\Users\Admin\AppData\Local\Temp\E087.tmp"93⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\E0D6.tmp"C:\Users\Admin\AppData\Local\Temp\E0D6.tmp"94⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\E133.tmp"C:\Users\Admin\AppData\Local\Temp\E133.tmp"95⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\E1A1.tmp"C:\Users\Admin\AppData\Local\Temp\E1A1.tmp"96⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\E21E.tmp"C:\Users\Admin\AppData\Local\Temp\E21E.tmp"97⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\E29B.tmp"C:\Users\Admin\AppData\Local\Temp\E29B.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\E2F8.tmp"C:\Users\Admin\AppData\Local\Temp\E2F8.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\E347.tmp"C:\Users\Admin\AppData\Local\Temp\E347.tmp"100⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\E395.tmp"C:\Users\Admin\AppData\Local\Temp\E395.tmp"101⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\E402.tmp"C:\Users\Admin\AppData\Local\Temp\E402.tmp"102⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\E450.tmp"C:\Users\Admin\AppData\Local\Temp\E450.tmp"103⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\E49E.tmp"C:\Users\Admin\AppData\Local\Temp\E49E.tmp"104⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"105⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\E53B.tmp"C:\Users\Admin\AppData\Local\Temp\E53B.tmp"106⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\E589.tmp"C:\Users\Admin\AppData\Local\Temp\E589.tmp"107⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\E5F6.tmp"C:\Users\Admin\AppData\Local\Temp\E5F6.tmp"108⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\E644.tmp"C:\Users\Admin\AppData\Local\Temp\E644.tmp"109⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\E692.tmp"C:\Users\Admin\AppData\Local\Temp\E692.tmp"110⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\E700.tmp"C:\Users\Admin\AppData\Local\Temp\E700.tmp"111⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\E75D.tmp"C:\Users\Admin\AppData\Local\Temp\E75D.tmp"112⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"113⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\E7FA.tmp"C:\Users\Admin\AppData\Local\Temp\E7FA.tmp"114⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\E848.tmp"C:\Users\Admin\AppData\Local\Temp\E848.tmp"115⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\E896.tmp"C:\Users\Admin\AppData\Local\Temp\E896.tmp"116⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\E903.tmp"C:\Users\Admin\AppData\Local\Temp\E903.tmp"117⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\E951.tmp"C:\Users\Admin\AppData\Local\Temp\E951.tmp"118⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\E9A0.tmp"C:\Users\Admin\AppData\Local\Temp\E9A0.tmp"119⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\EA0D.tmp"C:\Users\Admin\AppData\Local\Temp\EA0D.tmp"120⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\EA7A.tmp"C:\Users\Admin\AppData\Local\Temp\EA7A.tmp"121⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\EAC8.tmp"C:\Users\Admin\AppData\Local\Temp\EAC8.tmp"122⤵PID:2548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-