Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/06/2026, 04:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_9c8082754ce2b6247d4d7143e796504b_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_9c8082754ce2b6247d4d7143e796504b_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260618-en
14 signatures
150 seconds
General
- Target 2026-06-27_9c8082754ce2b6247d4d7143e796504b_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260629-e95yfsds6t
- SHA256 ae491f36b9d0741f4f9387856cf82acaec63f296c364da7c0d4b1a3ac787984d
- MD5 9c8082754ce2b6247d4d7143e796504b
- SHA1 646ace22160efeb169995d297f099e62212f3206
- SHA512 2b924bc1781b8983faf71d25ff62d0a2d5b29a86be6bff97dcd914c07bdbac5d06cdcee7a62bd64d8436aaf21ba0aac9d42368a2ac3cc17163b84a09ef6f21c0
- SSDEEP 12288:NU5rCOTeijHQXVl8/8TEy+rpP+ZsXBlScX3rmDt99TZwlH:NUQOJjHQFgsMPdXxyv9TSlH
- TLSH T181B4E026B585C032E69201714EE6E7F26A3B7D315B22A9C33BC4662E2FB52D1D375307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4460 1400.tmp 3100 148D.tmp 2580 14FA.tmp 4004 1577.tmp 3992 1604.tmp 5092 1671.tmp 1572 16DE.tmp 2872 172D.tmp 552 177B.tmp 860 17F8.tmp 3260 1875.tmp 1176 18F2.tmp 2780 196F.tmp 1196 19EC.tmp 3844 1A3A.tmp 4760 1A88.tmp 4852 1AE6.tmp 2488 1B53.tmp 4156 1BC0.tmp 4820 1C0F.tmp 2868 1C7C.tmp 3880 1CCA.tmp 2240 1D28.tmp 2432 1DA5.tmp 224 1E03.tmp 1328 1E60.tmp 1744 1EAE.tmp 3772 1F0C.tmp 2592 1F7A.tmp 560 1FC8.tmp 4544 2025.tmp 1292 2064.tmp 4380 20B2.tmp 2660 20F1.tmp 1404 213F.tmp 3440 219C.tmp 3120 21EB.tmp 2380 2239.tmp 1192 2277.tmp 1356 22C5.tmp 3264 2323.tmp 2620 2362.tmp 3688 23A0.tmp 1692 23FE.tmp 2040 244C.tmp 4428 249A.tmp 3324 24E8.tmp 4144 2536.tmp 4176 2575.tmp 3932 25D3.tmp 3200 2621.tmp 4108 267E.tmp 4052 26CD.tmp 4128 270B.tmp 4676 2759.tmp 1476 2798.tmp 1688 27D6.tmp 3592 2834.tmp 2556 2872.tmp 3948 28D0.tmp 4668 290F.tmp 3008 296C.tmp 3232 29BB.tmp 452 2A09.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E02A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A062.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 408A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C908.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5569.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2798.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 528B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4124 wrote to memory of 4460 4124 2026-06-27_9c8082754ce2b6247d4d7143e796504b_elex_mafia_stealc_tofsee.exe 85 PID 4460 wrote to memory of 3100 4460 1400.tmp 86 PID 3100 wrote to memory of 2580 3100 148D.tmp 87 PID 2580 wrote to memory of 4004 2580 14FA.tmp 88 PID 4004 wrote to memory of 3992 4004 1577.tmp 89 PID 3992 wrote to memory of 5092 3992 1604.tmp 90 PID 5092 wrote to memory of 1572 5092 1671.tmp 91 PID 1572 wrote to memory of 2872 1572 16DE.tmp 92 PID 2872 wrote to memory of 552 2872 172D.tmp 93 PID 552 wrote to memory of 860 552 177B.tmp 94 PID 860 wrote to memory of 3260 860 17F8.tmp 95 PID 3260 wrote to memory of 1176 3260 1875.tmp 96 PID 1176 wrote to memory of 2780 1176 18F2.tmp 97 PID 2780 wrote to memory of 1196 2780 196F.tmp 98 PID 1196 wrote to memory of 3844 1196 19EC.tmp 99 PID 3844 wrote to memory of 4760 3844 1A3A.tmp 100 PID 4760 wrote to memory of 4852 4760 1A88.tmp 101 PID 4852 wrote to memory of 2488 4852 1AE6.tmp 102 PID 2488 wrote to memory of 4156 2488 1B53.tmp 103 PID 4156 wrote to memory of 4820 4156 1BC0.tmp 104 PID 4820 wrote to memory of 2868 4820 1C0F.tmp 105 PID 2868 wrote to memory of 3880 2868 1C7C.tmp 106 PID 3880 wrote to memory of 2240 3880 1CCA.tmp 107 PID 2240 wrote to memory of 2432 2240 1D28.tmp 108 PID 2432 wrote to memory of 224 2432 1DA5.tmp 109 PID 224 wrote to memory of 1328 224 1E03.tmp 110 PID 1328 wrote to memory of 1744 1328 1E60.tmp 111 PID 1744 wrote to memory of 3772 1744 1EAE.tmp 112 PID 3772 wrote to memory of 2592 3772 1F0C.tmp 113 PID 2592 wrote to memory of 560 2592 1F7A.tmp 114 PID 560 wrote to memory of 4544 560 1FC8.tmp 115 PID 4544 wrote to memory of 1292 4544 2025.tmp 116 PID 1292 wrote to memory of 4380 1292 2064.tmp 117 PID 4380 wrote to memory of 2660 4380 20B2.tmp 118 PID 2660 wrote to memory of 1404 2660 20F1.tmp 119 PID 1404 wrote to memory of 3440 1404 213F.tmp 120 PID 3440 wrote to memory of 3120 3440 219C.tmp 121 PID 3120 wrote to memory of 2380 3120 21EB.tmp 122 PID 2380 wrote to memory of 1192 2380 2239.tmp 123 PID 1192 wrote to memory of 1356 1192 2277.tmp 124 PID 1356 wrote to memory of 3264 1356 22C5.tmp 125 PID 3264 wrote to memory of 2620 3264 2323.tmp 126 PID 2620 wrote to memory of 3688 2620 2362.tmp 127 PID 3688 wrote to memory of 1692 3688 23A0.tmp 128 PID 1692 wrote to memory of 2040 1692 23FE.tmp 129 PID 2040 wrote to memory of 4428 2040 244C.tmp 130 PID 4428 wrote to memory of 3324 4428 249A.tmp 131 PID 3324 wrote to memory of 4144 3324 24E8.tmp 132 PID 4144 wrote to memory of 4176 4144 2536.tmp 133 PID 4176 wrote to memory of 3932 4176 2575.tmp 134 PID 3932 wrote to memory of 3200 3932 25D3.tmp 135 PID 3200 wrote to memory of 4108 3200 2621.tmp 136 PID 4108 wrote to memory of 4052 4108 267E.tmp 137 PID 4052 wrote to memory of 4128 4052 26CD.tmp 138 PID 4128 wrote to memory of 4676 4128 270B.tmp 139 PID 4676 wrote to memory of 1476 4676 2759.tmp 140 PID 1476 wrote to memory of 1688 1476 2798.tmp 141 PID 1688 wrote to memory of 3592 1688 27D6.tmp 142 PID 3592 wrote to memory of 2556 3592 2834.tmp 143 PID 2556 wrote to memory of 3948 2556 2872.tmp 144 PID 3948 wrote to memory of 4668 3948 28D0.tmp 145 PID 4668 wrote to memory of 3008 4668 290F.tmp 146 PID 3008 wrote to memory of 3232 3008 296C.tmp 147 PID 3232 wrote to memory of 452 3232 29BB.tmp 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_9c8082754ce2b6247d4d7143e796504b_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_9c8082754ce2b6247d4d7143e796504b_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\148D.tmp"C:\Users\Admin\AppData\Local\Temp\148D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\14FA.tmp"C:\Users\Admin\AppData\Local\Temp\14FA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\1671.tmp"C:\Users\Admin\AppData\Local\Temp\1671.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\16DE.tmp"C:\Users\Admin\AppData\Local\Temp\16DE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\172D.tmp"C:\Users\Admin\AppData\Local\Temp\172D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\177B.tmp"C:\Users\Admin\AppData\Local\Temp\177B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\17F8.tmp"C:\Users\Admin\AppData\Local\Temp\17F8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\19EC.tmp"C:\Users\Admin\AppData\Local\Temp\19EC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\1A88.tmp"C:\Users\Admin\AppData\Local\Temp\1A88.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\1B53.tmp"C:\Users\Admin\AppData\Local\Temp\1B53.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"C:\Users\Admin\AppData\Local\Temp\1BC0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\1D28.tmp"C:\Users\Admin\AppData\Local\Temp\1D28.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\1E03.tmp"C:\Users\Admin\AppData\Local\Temp\1E03.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\1E60.tmp"C:\Users\Admin\AppData\Local\Temp\1E60.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\2025.tmp"C:\Users\Admin\AppData\Local\Temp\2025.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\2064.tmp"C:\Users\Admin\AppData\Local\Temp\2064.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\20B2.tmp"C:\Users\Admin\AppData\Local\Temp\20B2.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\20F1.tmp"C:\Users\Admin\AppData\Local\Temp\20F1.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\219C.tmp"C:\Users\Admin\AppData\Local\Temp\219C.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\21EB.tmp"C:\Users\Admin\AppData\Local\Temp\21EB.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\2362.tmp"C:\Users\Admin\AppData\Local\Temp\2362.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\23A0.tmp"C:\Users\Admin\AppData\Local\Temp\23A0.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\23FE.tmp"C:\Users\Admin\AppData\Local\Temp\23FE.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\244C.tmp"C:\Users\Admin\AppData\Local\Temp\244C.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\249A.tmp"C:\Users\Admin\AppData\Local\Temp\249A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\2536.tmp"C:\Users\Admin\AppData\Local\Temp\2536.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\2575.tmp"C:\Users\Admin\AppData\Local\Temp\2575.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\267E.tmp"C:\Users\Admin\AppData\Local\Temp\267E.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\26CD.tmp"C:\Users\Admin\AppData\Local\Temp\26CD.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\270B.tmp"C:\Users\Admin\AppData\Local\Temp\270B.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\2798.tmp"C:\Users\Admin\AppData\Local\Temp\2798.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\27D6.tmp"C:\Users\Admin\AppData\Local\Temp\27D6.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\2872.tmp"C:\Users\Admin\AppData\Local\Temp\2872.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\28D0.tmp"C:\Users\Admin\AppData\Local\Temp\28D0.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\290F.tmp"C:\Users\Admin\AppData\Local\Temp\290F.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\296C.tmp"C:\Users\Admin\AppData\Local\Temp\296C.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\29BB.tmp"C:\Users\Admin\AppData\Local\Temp\29BB.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\2A09.tmp"C:\Users\Admin\AppData\Local\Temp\2A09.tmp"65⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\2A66.tmp"C:\Users\Admin\AppData\Local\Temp\2A66.tmp"66⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"67⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\2B03.tmp"C:\Users\Admin\AppData\Local\Temp\2B03.tmp"68⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\2B51.tmp"C:\Users\Admin\AppData\Local\Temp\2B51.tmp"69⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"70⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"71⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"72⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\2C89.tmp"C:\Users\Admin\AppData\Local\Temp\2C89.tmp"73⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"74⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\2D16.tmp"C:\Users\Admin\AppData\Local\Temp\2D16.tmp"75⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\2D64.tmp"C:\Users\Admin\AppData\Local\Temp\2D64.tmp"76⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"77⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"78⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"79⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"80⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"81⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"82⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\2F48.tmp"C:\Users\Admin\AppData\Local\Temp\2F48.tmp"83⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"84⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"85⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\3042.tmp"C:\Users\Admin\AppData\Local\Temp\3042.tmp"86⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\3081.tmp"C:\Users\Admin\AppData\Local\Temp\3081.tmp"87⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\30BF.tmp"C:\Users\Admin\AppData\Local\Temp\30BF.tmp"88⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\30FE.tmp"C:\Users\Admin\AppData\Local\Temp\30FE.tmp"89⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\315C.tmp"C:\Users\Admin\AppData\Local\Temp\315C.tmp"90⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"91⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\31F8.tmp"C:\Users\Admin\AppData\Local\Temp\31F8.tmp"92⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"93⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\32B3.tmp"C:\Users\Admin\AppData\Local\Temp\32B3.tmp"94⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"95⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\335F.tmp"C:\Users\Admin\AppData\Local\Temp\335F.tmp"96⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\33AD.tmp"C:\Users\Admin\AppData\Local\Temp\33AD.tmp"97⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"98⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"99⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"100⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\3544.tmp"C:\Users\Admin\AppData\Local\Temp\3544.tmp"102⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\3592.tmp"C:\Users\Admin\AppData\Local\Temp\3592.tmp"103⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\35E0.tmp"C:\Users\Admin\AppData\Local\Temp\35E0.tmp"104⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"105⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\367C.tmp"C:\Users\Admin\AppData\Local\Temp\367C.tmp"106⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\36CA.tmp"C:\Users\Admin\AppData\Local\Temp\36CA.tmp"107⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\3728.tmp"C:\Users\Admin\AppData\Local\Temp\3728.tmp"108⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"109⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\37D4.tmp"C:\Users\Admin\AppData\Local\Temp\37D4.tmp"110⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\3812.tmp"C:\Users\Admin\AppData\Local\Temp\3812.tmp"111⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\3851.tmp"C:\Users\Admin\AppData\Local\Temp\3851.tmp"112⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\38AF.tmp"C:\Users\Admin\AppData\Local\Temp\38AF.tmp"113⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\390C.tmp"C:\Users\Admin\AppData\Local\Temp\390C.tmp"114⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"115⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\39A9.tmp"C:\Users\Admin\AppData\Local\Temp\39A9.tmp"116⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\3A06.tmp"C:\Users\Admin\AppData\Local\Temp\3A06.tmp"117⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\3A55.tmp"C:\Users\Admin\AppData\Local\Temp\3A55.tmp"118⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"119⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\3B10.tmp"C:\Users\Admin\AppData\Local\Temp\3B10.tmp"120⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"121⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"122⤵PID:3888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-