Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/06/2026, 07:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_4f84a29b876198d3ebc93f6ff9a5476f_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_4f84a29b876198d3ebc93f6ff9a5476f_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260617-en
3 signatures
150 seconds
General
- Target 2026-06-27_4f84a29b876198d3ebc93f6ff9a5476f_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260629-jcvtfags21
- SHA256 297ff7d1c3a83e2755ab9a1542fd37ed4c062c191e85c314eaa76c07e44cfa0e
- MD5 4f84a29b876198d3ebc93f6ff9a5476f
- SHA1 1477c072a521eeca735eaa6a4a42f297ffeabad5
- SHA512 59f566a3286bb0cdc1166be0ca4c5928d671a37d945868d1f9950c6afd992c311d32cc000337852b467727e5c67e7266cb221ce590096071c174f9628c3f24a7
- SSDEEP 12288:NU5rCOTeijXX7z2A1Q+Fkzi5Dtlb3d7TZwlH:NUQOJjXLf1PbHlb3d7TSlH
- TLSH T1C6B4F125B585C132E6D212710AE6EBA1693FBD31573690C33B84A66E2FB63E1D335343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4340 2A95.tmp 2972 2AF3.tmp 3984 2B60.tmp 4948 2BFD.tmp 2380 2C5A.tmp 3872 2CB8.tmp 1608 2D45.tmp 4376 2D93.tmp 4904 2E00.tmp 1576 2E6E.tmp 1884 2EBC.tmp 2552 2F39.tmp 3500 2FA6.tmp 1348 3014.tmp 5000 3062.tmp 1888 30BF.tmp 3900 313C.tmp 4480 31B9.tmp 3024 3236.tmp 4908 32B3.tmp 4624 3330.tmp 5096 338E.tmp 2656 33EC.tmp 3568 343A.tmp 3960 3488.tmp 4292 34E6.tmp 3404 3563.tmp 3180 35E0.tmp 1344 366D.tmp 2700 36EA.tmp 4008 3767.tmp 2240 37D4.tmp 4264 3851.tmp 1492 388F.tmp 3168 38DE.tmp 348 391C.tmp 972 396A.tmp 4996 39C8.tmp 2760 3A26.tmp 1360 3A74.tmp 1004 3AC2.tmp 8 3B20.tmp 3416 3B7D.tmp 456 3BBC.tmp 3532 3C0A.tmp 1756 3C58.tmp 4308 3CB6.tmp 4136 3D04.tmp 2100 3D62.tmp 756 3DDF.tmp 2520 3E1D.tmp 2536 3E6B.tmp 4132 3EAA.tmp 672 3EE8.tmp 4452 3F37.tmp 2424 3F85.tmp 4064 3FE2.tmp 2588 4031.tmp 3832 407F.tmp 768 40DC.tmp 3932 412B.tmp 3120 4179.tmp 1444 41B7.tmp 4372 4215.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1831.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4457.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 284E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5493.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E366.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 967E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1061.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 724D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D116.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D54C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4627.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5058.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1265.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2496 wrote to memory of 4340 2496 2026-06-27_4f84a29b876198d3ebc93f6ff9a5476f_elex_mafia_stealc_tofsee.exe 84 PID 4340 wrote to memory of 2972 4340 2A95.tmp 85 PID 2972 wrote to memory of 3984 2972 2AF3.tmp 86 PID 3984 wrote to memory of 4948 3984 2B60.tmp 87 PID 4948 wrote to memory of 2380 4948 2BFD.tmp 88 PID 2380 wrote to memory of 3872 2380 2C5A.tmp 89 PID 3872 wrote to memory of 1608 3872 2CB8.tmp 90 PID 1608 wrote to memory of 4376 1608 2D45.tmp 91 PID 4376 wrote to memory of 4904 4376 2D93.tmp 92 PID 4904 wrote to memory of 1576 4904 2E00.tmp 93 PID 1576 wrote to memory of 1884 1576 2E6E.tmp 94 PID 1884 wrote to memory of 2552 1884 2EBC.tmp 95 PID 2552 wrote to memory of 3500 2552 2F39.tmp 96 PID 3500 wrote to memory of 1348 3500 2FA6.tmp 97 PID 1348 wrote to memory of 5000 1348 3014.tmp 98 PID 5000 wrote to memory of 1888 5000 3062.tmp 99 PID 1888 wrote to memory of 3900 1888 30BF.tmp 100 PID 3900 wrote to memory of 4480 3900 313C.tmp 101 PID 4480 wrote to memory of 3024 4480 31B9.tmp 102 PID 3024 wrote to memory of 4908 3024 3236.tmp 103 PID 4908 wrote to memory of 4624 4908 32B3.tmp 104 PID 4624 wrote to memory of 5096 4624 3330.tmp 105 PID 5096 wrote to memory of 2656 5096 338E.tmp 106 PID 2656 wrote to memory of 3568 2656 33EC.tmp 107 PID 3568 wrote to memory of 3960 3568 343A.tmp 108 PID 3960 wrote to memory of 4292 3960 3488.tmp 109 PID 4292 wrote to memory of 3404 4292 34E6.tmp 110 PID 3404 wrote to memory of 3180 3404 3563.tmp 111 PID 3180 wrote to memory of 1344 3180 35E0.tmp 112 PID 1344 wrote to memory of 2700 1344 366D.tmp 113 PID 2700 wrote to memory of 4008 2700 36EA.tmp 114 PID 4008 wrote to memory of 2240 4008 3767.tmp 115 PID 2240 wrote to memory of 4264 2240 37D4.tmp 116 PID 4264 wrote to memory of 1492 4264 3851.tmp 117 PID 1492 wrote to memory of 3168 1492 388F.tmp 118 PID 3168 wrote to memory of 348 3168 38DE.tmp 119 PID 348 wrote to memory of 972 348 391C.tmp 120 PID 972 wrote to memory of 4996 972 396A.tmp 121 PID 4996 wrote to memory of 2760 4996 39C8.tmp 122 PID 2760 wrote to memory of 1360 2760 3A26.tmp 123 PID 1360 wrote to memory of 1004 1360 3A74.tmp 124 PID 1004 wrote to memory of 8 1004 3AC2.tmp 125 PID 8 wrote to memory of 3416 8 3B20.tmp 126 PID 3416 wrote to memory of 456 3416 3B7D.tmp 127 PID 456 wrote to memory of 3532 456 3BBC.tmp 128 PID 3532 wrote to memory of 1756 3532 3C0A.tmp 129 PID 1756 wrote to memory of 4308 1756 3C58.tmp 130 PID 4308 wrote to memory of 4136 4308 3CB6.tmp 131 PID 4136 wrote to memory of 2100 4136 3D04.tmp 132 PID 2100 wrote to memory of 756 2100 3D62.tmp 133 PID 756 wrote to memory of 2520 756 3DDF.tmp 134 PID 2520 wrote to memory of 2536 2520 3E1D.tmp 135 PID 2536 wrote to memory of 4132 2536 3E6B.tmp 136 PID 4132 wrote to memory of 672 4132 3EAA.tmp 137 PID 672 wrote to memory of 4452 672 3EE8.tmp 138 PID 4452 wrote to memory of 2424 4452 3F37.tmp 139 PID 2424 wrote to memory of 4064 2424 3F85.tmp 140 PID 4064 wrote to memory of 2588 4064 3FE2.tmp 141 PID 2588 wrote to memory of 3832 2588 4031.tmp 142 PID 3832 wrote to memory of 768 3832 407F.tmp 143 PID 768 wrote to memory of 3932 768 40DC.tmp 144 PID 3932 wrote to memory of 3120 3932 412B.tmp 145 PID 3120 wrote to memory of 1444 3120 4179.tmp 146 PID 1444 wrote to memory of 4372 1444 41B7.tmp 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_4f84a29b876198d3ebc93f6ff9a5476f_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_4f84a29b876198d3ebc93f6ff9a5476f_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\2A95.tmp"C:\Users\Admin\AppData\Local\Temp\2A95.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\2B60.tmp"C:\Users\Admin\AppData\Local\Temp\2B60.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\2D45.tmp"C:\Users\Admin\AppData\Local\Temp\2D45.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\2D93.tmp"C:\Users\Admin\AppData\Local\Temp\2D93.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\2E00.tmp"C:\Users\Admin\AppData\Local\Temp\2E00.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\2F39.tmp"C:\Users\Admin\AppData\Local\Temp\2F39.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\3014.tmp"C:\Users\Admin\AppData\Local\Temp\3014.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\3062.tmp"C:\Users\Admin\AppData\Local\Temp\3062.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\30BF.tmp"C:\Users\Admin\AppData\Local\Temp\30BF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\313C.tmp"C:\Users\Admin\AppData\Local\Temp\313C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\3236.tmp"C:\Users\Admin\AppData\Local\Temp\3236.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\32B3.tmp"C:\Users\Admin\AppData\Local\Temp\32B3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\3330.tmp"C:\Users\Admin\AppData\Local\Temp\3330.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\3563.tmp"C:\Users\Admin\AppData\Local\Temp\3563.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\35E0.tmp"C:\Users\Admin\AppData\Local\Temp\35E0.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\36EA.tmp"C:\Users\Admin\AppData\Local\Temp\36EA.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\3767.tmp"C:\Users\Admin\AppData\Local\Temp\3767.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\37D4.tmp"C:\Users\Admin\AppData\Local\Temp\37D4.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\3851.tmp"C:\Users\Admin\AppData\Local\Temp\3851.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\388F.tmp"C:\Users\Admin\AppData\Local\Temp\388F.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\38DE.tmp"C:\Users\Admin\AppData\Local\Temp\38DE.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\391C.tmp"C:\Users\Admin\AppData\Local\Temp\391C.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\39C8.tmp"C:\Users\Admin\AppData\Local\Temp\39C8.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\3A26.tmp"C:\Users\Admin\AppData\Local\Temp\3A26.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\3A74.tmp"C:\Users\Admin\AppData\Local\Temp\3A74.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\3B20.tmp"C:\Users\Admin\AppData\Local\Temp\3B20.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"C:\Users\Admin\AppData\Local\Temp\3C0A.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\3C58.tmp"C:\Users\Admin\AppData\Local\Temp\3C58.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\3D04.tmp"C:\Users\Admin\AppData\Local\Temp\3D04.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\3D62.tmp"C:\Users\Admin\AppData\Local\Temp\3D62.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\3F37.tmp"C:\Users\Admin\AppData\Local\Temp\3F37.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\3F85.tmp"C:\Users\Admin\AppData\Local\Temp\3F85.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\4031.tmp"C:\Users\Admin\AppData\Local\Temp\4031.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\407F.tmp"C:\Users\Admin\AppData\Local\Temp\407F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\40DC.tmp"C:\Users\Admin\AppData\Local\Temp\40DC.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\412B.tmp"C:\Users\Admin\AppData\Local\Temp\412B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\4179.tmp"C:\Users\Admin\AppData\Local\Temp\4179.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\41B7.tmp"C:\Users\Admin\AppData\Local\Temp\41B7.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\4215.tmp"C:\Users\Admin\AppData\Local\Temp\4215.tmp"65⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\4263.tmp"C:\Users\Admin\AppData\Local\Temp\4263.tmp"66⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"67⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\42E0.tmp"C:\Users\Admin\AppData\Local\Temp\42E0.tmp"68⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"69⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\437C.tmp"C:\Users\Admin\AppData\Local\Temp\437C.tmp"70⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\43BB.tmp"C:\Users\Admin\AppData\Local\Temp\43BB.tmp"71⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"72⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\4457.tmp"C:\Users\Admin\AppData\Local\Temp\4457.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:560 -
C:\Users\Admin\AppData\Local\Temp\4496.tmp"C:\Users\Admin\AppData\Local\Temp\4496.tmp"74⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\44E4.tmp"C:\Users\Admin\AppData\Local\Temp\44E4.tmp"75⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\4541.tmp"C:\Users\Admin\AppData\Local\Temp\4541.tmp"76⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\4590.tmp"C:\Users\Admin\AppData\Local\Temp\4590.tmp"77⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\45DE.tmp"C:\Users\Admin\AppData\Local\Temp\45DE.tmp"78⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\462C.tmp"C:\Users\Admin\AppData\Local\Temp\462C.tmp"79⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\468A.tmp"C:\Users\Admin\AppData\Local\Temp\468A.tmp"80⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\46D8.tmp"C:\Users\Admin\AppData\Local\Temp\46D8.tmp"81⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\4716.tmp"C:\Users\Admin\AppData\Local\Temp\4716.tmp"82⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\4774.tmp"C:\Users\Admin\AppData\Local\Temp\4774.tmp"83⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\47D2.tmp"C:\Users\Admin\AppData\Local\Temp\47D2.tmp"84⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\4820.tmp"C:\Users\Admin\AppData\Local\Temp\4820.tmp"85⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\487E.tmp"C:\Users\Admin\AppData\Local\Temp\487E.tmp"86⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\48DB.tmp"C:\Users\Admin\AppData\Local\Temp\48DB.tmp"87⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\4939.tmp"C:\Users\Admin\AppData\Local\Temp\4939.tmp"88⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\4997.tmp"C:\Users\Admin\AppData\Local\Temp\4997.tmp"89⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\49E5.tmp"C:\Users\Admin\AppData\Local\Temp\49E5.tmp"90⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\4A43.tmp"C:\Users\Admin\AppData\Local\Temp\4A43.tmp"91⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"92⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"93⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"C:\Users\Admin\AppData\Local\Temp\4B4C.tmp"94⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"C:\Users\Admin\AppData\Local\Temp\4BAA.tmp"95⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\4C08.tmp"C:\Users\Admin\AppData\Local\Temp\4C08.tmp"96⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\4C66.tmp"C:\Users\Admin\AppData\Local\Temp\4C66.tmp"97⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"98⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\4D02.tmp"C:\Users\Admin\AppData\Local\Temp\4D02.tmp"99⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\4D50.tmp"C:\Users\Admin\AppData\Local\Temp\4D50.tmp"100⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"101⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"102⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"103⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\4E98.tmp"C:\Users\Admin\AppData\Local\Temp\4E98.tmp"104⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"105⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\4F44.tmp"C:\Users\Admin\AppData\Local\Temp\4F44.tmp"106⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\4F92.tmp"C:\Users\Admin\AppData\Local\Temp\4F92.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"108⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\504E.tmp"C:\Users\Admin\AppData\Local\Temp\504E.tmp"109⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\509C.tmp"C:\Users\Admin\AppData\Local\Temp\509C.tmp"110⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\50F9.tmp"C:\Users\Admin\AppData\Local\Temp\50F9.tmp"111⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\5148.tmp"C:\Users\Admin\AppData\Local\Temp\5148.tmp"112⤵PID:3228
-
C:\Users\Admin\AppData\Local\Temp\5196.tmp"C:\Users\Admin\AppData\Local\Temp\5196.tmp"113⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\51E4.tmp"C:\Users\Admin\AppData\Local\Temp\51E4.tmp"114⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\5222.tmp"C:\Users\Admin\AppData\Local\Temp\5222.tmp"115⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\5270.tmp"C:\Users\Admin\AppData\Local\Temp\5270.tmp"116⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\52BF.tmp"C:\Users\Admin\AppData\Local\Temp\52BF.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\530D.tmp"C:\Users\Admin\AppData\Local\Temp\530D.tmp"118⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\535B.tmp"C:\Users\Admin\AppData\Local\Temp\535B.tmp"119⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\53A9.tmp"C:\Users\Admin\AppData\Local\Temp\53A9.tmp"120⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\53F7.tmp"C:\Users\Admin\AppData\Local\Temp\53F7.tmp"121⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\5445.tmp"C:\Users\Admin\AppData\Local\Temp\5445.tmp"122⤵PID:1100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-