Analysis
- max time kernel
150s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/08/2026, 01:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_ff343d1370a180d726a5ced0bbca2c1a_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_ff343d1370a180d726a5ced0bbca2c1a_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-01_ff343d1370a180d726a5ced0bbca2c1a_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260801-bcnfcsthrf
- SHA256 81141f19cf50870d3a2814246a95b5ed9a16ffc680743ced08d31039e37a61b1
- MD5 ff343d1370a180d726a5ced0bbca2c1a
- SHA1 58d2295270e7619846e20efda1ab4797c1163aca
- SHA512 66baae9deb1081dbf2fe186599491b42a697ba44c3e9f3f2daf480a1df3f2943bccf21612aeb33206fc5886b3b420098a703e802adb8ca20fb6fceb7bbbe0de9
- SSDEEP 12288:wU5rCOTeiDVv31Ndz1+kwIajvwdhtNPJ93PNZ+3/v+I9hUG2VA:wUQOJD7bzOBvwlNPzPNGEA
- TLSH T10EE4D12177D88536E9FB037859F5E6645D7EBD226722D6CF2F8015AE0AB1BC08631323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4100 1B72.tmp 4624 1CBA.tmp 1768 1EBE.tmp 1288 1FD7.tmp 2720 211F.tmp 3988 2258.tmp 776 23DF.tmp 1712 24F8.tmp 4584 2630.tmp 3752 2778.tmp 1232 28D0.tmp 2516 29DA.tmp 4392 2AB5.tmp 3916 2BAF.tmp 1480 2CA9.tmp 652 2DC2.tmp 3120 2ECB.tmp 2544 2F68.tmp 2804 30FE.tmp 980 3236.tmp 1820 3321.tmp 1284 33FC.tmp 2980 3515.tmp 4964 360F.tmp 3368 3709.tmp 2616 37E4.tmp 1728 392C.tmp 1692 39B8.tmp 3432 3A16.tmp 2316 3AC2.tmp 3616 3B9D.tmp 1120 3C49.tmp 3784 3CD5.tmp 1032 3D43.tmp 2352 3DA0.tmp 4052 3DEE.tmp 1420 3E4C.tmp 4460 3EBA.tmp 2776 3F08.tmp 1520 3F65.tmp 3036 3FB4.tmp 3092 4002.tmp 4752 407F.tmp 4284 40DC.tmp 3200 412B.tmp 4280 4198.tmp 4884 4205.tmp 1280 4263.tmp 4312 42D0.tmp 3956 432E.tmp 520 438C.tmp 1772 43DA.tmp 2208 4428.tmp 4760 4476.tmp 3112 44D4.tmp 332 4522.tmp 4240 459F.tmp 4176 45ED.tmp 1244 464B.tmp 4580 4699.tmp 3252 46F7.tmp 5096 4745.tmp 1720 4793.tmp 4704 47F1.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9824.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D80C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9229.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C84C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C33B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F642.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ABB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C484.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1217.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5242.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A989.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2997.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2169.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4201.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6695.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9277.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C04D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E385.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 262C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 360F.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 4100 2644 2026-08-01_ff343d1370a180d726a5ced0bbca2c1a_elex_mafia_stealc_tofsee.exe 85 PID 4100 wrote to memory of 4624 4100 1B72.tmp 86 PID 4624 wrote to memory of 1768 4624 1CBA.tmp 87 PID 1768 wrote to memory of 1288 1768 1EBE.tmp 88 PID 1288 wrote to memory of 2720 1288 1FD7.tmp 89 PID 2720 wrote to memory of 3988 2720 211F.tmp 90 PID 3988 wrote to memory of 776 3988 2258.tmp 91 PID 776 wrote to memory of 1712 776 23DF.tmp 92 PID 1712 wrote to memory of 4584 1712 24F8.tmp 93 PID 4584 wrote to memory of 3752 4584 2630.tmp 94 PID 3752 wrote to memory of 1232 3752 2778.tmp 95 PID 1232 wrote to memory of 2516 1232 28D0.tmp 98 PID 2516 wrote to memory of 4392 2516 29DA.tmp 99 PID 4392 wrote to memory of 3916 4392 2AB5.tmp 100 PID 3916 wrote to memory of 1480 3916 2BAF.tmp 101 PID 1480 wrote to memory of 652 1480 2CA9.tmp 102 PID 652 wrote to memory of 3120 652 2DC2.tmp 104 PID 3120 wrote to memory of 2544 3120 2ECB.tmp 106 PID 2544 wrote to memory of 2804 2544 2F68.tmp 107 PID 2804 wrote to memory of 980 2804 30FE.tmp 108 PID 980 wrote to memory of 1820 980 3236.tmp 109 PID 1820 wrote to memory of 1284 1820 3321.tmp 110 PID 1284 wrote to memory of 2980 1284 33FC.tmp 111 PID 2980 wrote to memory of 4964 2980 3515.tmp 112 PID 4964 wrote to memory of 3368 4964 360F.tmp 113 PID 3368 wrote to memory of 2616 3368 3709.tmp 114 PID 2616 wrote to memory of 1728 2616 37E4.tmp 115 PID 1728 wrote to memory of 1692 1728 392C.tmp 116 PID 1692 wrote to memory of 3432 1692 39B8.tmp 118 PID 3432 wrote to memory of 2316 3432 3A16.tmp 119 PID 2316 wrote to memory of 3616 2316 3AC2.tmp 120 PID 3616 wrote to memory of 1120 3616 3B9D.tmp 121 PID 1120 wrote to memory of 3784 1120 3C49.tmp 122 PID 3784 wrote to memory of 1032 3784 3CD5.tmp 123 PID 1032 wrote to memory of 2352 1032 3D43.tmp 124 PID 2352 wrote to memory of 4052 2352 3DA0.tmp 125 PID 4052 wrote to memory of 1420 4052 3DEE.tmp 126 PID 1420 wrote to memory of 4460 1420 3E4C.tmp 127 PID 4460 wrote to memory of 2776 4460 3EBA.tmp 128 PID 2776 wrote to memory of 1520 2776 3F08.tmp 129 PID 1520 wrote to memory of 3036 1520 3F65.tmp 130 PID 3036 wrote to memory of 3092 3036 3FB4.tmp 131 PID 3092 wrote to memory of 4752 3092 4002.tmp 132 PID 4752 wrote to memory of 4284 4752 407F.tmp 133 PID 4284 wrote to memory of 3200 4284 40DC.tmp 134 PID 3200 wrote to memory of 4280 3200 412B.tmp 135 PID 4280 wrote to memory of 4884 4280 4198.tmp 136 PID 4884 wrote to memory of 1280 4884 4205.tmp 137 PID 1280 wrote to memory of 4312 1280 4263.tmp 138 PID 4312 wrote to memory of 3956 4312 42D0.tmp 139 PID 3956 wrote to memory of 520 3956 432E.tmp 140 PID 520 wrote to memory of 1772 520 438C.tmp 141 PID 1772 wrote to memory of 2208 1772 43DA.tmp 142 PID 2208 wrote to memory of 4760 2208 4428.tmp 143 PID 4760 wrote to memory of 3112 4760 4476.tmp 144 PID 3112 wrote to memory of 332 3112 44D4.tmp 145 PID 332 wrote to memory of 4240 332 4522.tmp 147 PID 4240 wrote to memory of 4176 4240 459F.tmp 149 PID 4176 wrote to memory of 1244 4176 45ED.tmp 150 PID 1244 wrote to memory of 4580 1244 464B.tmp 151 PID 4580 wrote to memory of 3252 4580 4699.tmp 152 PID 3252 wrote to memory of 5096 3252 46F7.tmp 153 PID 5096 wrote to memory of 1720 5096 4745.tmp 155 PID 1720 wrote to memory of 4704 1720 4793.tmp 156
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_ff343d1370a180d726a5ced0bbca2c1a_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_ff343d1370a180d726a5ced0bbca2c1a_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\1B72.tmp"C:\Users\Admin\AppData\Local\Temp\1B72.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\211F.tmp"C:\Users\Admin\AppData\Local\Temp\211F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\2258.tmp"C:\Users\Admin\AppData\Local\Temp\2258.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\23DF.tmp"C:\Users\Admin\AppData\Local\Temp\23DF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\24F8.tmp"C:\Users\Admin\AppData\Local\Temp\24F8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\2778.tmp"C:\Users\Admin\AppData\Local\Temp\2778.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\28D0.tmp"C:\Users\Admin\AppData\Local\Temp\28D0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\29DA.tmp"C:\Users\Admin\AppData\Local\Temp\29DA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"C:\Users\Admin\AppData\Local\Temp\2AB5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"C:\Users\Admin\AppData\Local\Temp\2ECB.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\2F68.tmp"C:\Users\Admin\AppData\Local\Temp\2F68.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\30FE.tmp"C:\Users\Admin\AppData\Local\Temp\30FE.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\3236.tmp"C:\Users\Admin\AppData\Local\Temp\3236.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\3515.tmp"C:\Users\Admin\AppData\Local\Temp\3515.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\360F.tmp"C:\Users\Admin\AppData\Local\Temp\360F.tmp"25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\3709.tmp"C:\Users\Admin\AppData\Local\Temp\3709.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\392C.tmp"C:\Users\Admin\AppData\Local\Temp\392C.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\39B8.tmp"C:\Users\Admin\AppData\Local\Temp\39B8.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\3A16.tmp"C:\Users\Admin\AppData\Local\Temp\3A16.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\3C49.tmp"C:\Users\Admin\AppData\Local\Temp\3C49.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\3CD5.tmp"C:\Users\Admin\AppData\Local\Temp\3CD5.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\3D43.tmp"C:\Users\Admin\AppData\Local\Temp\3D43.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\3EBA.tmp"C:\Users\Admin\AppData\Local\Temp\3EBA.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\3F08.tmp"C:\Users\Admin\AppData\Local\Temp\3F08.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\3F65.tmp"C:\Users\Admin\AppData\Local\Temp\3F65.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\4002.tmp"C:\Users\Admin\AppData\Local\Temp\4002.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\407F.tmp"C:\Users\Admin\AppData\Local\Temp\407F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\40DC.tmp"C:\Users\Admin\AppData\Local\Temp\40DC.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\412B.tmp"C:\Users\Admin\AppData\Local\Temp\412B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\4198.tmp"C:\Users\Admin\AppData\Local\Temp\4198.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\4205.tmp"C:\Users\Admin\AppData\Local\Temp\4205.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\4263.tmp"C:\Users\Admin\AppData\Local\Temp\4263.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\42D0.tmp"C:\Users\Admin\AppData\Local\Temp\42D0.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\438C.tmp"C:\Users\Admin\AppData\Local\Temp\438C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Users\Admin\AppData\Local\Temp\43DA.tmp"C:\Users\Admin\AppData\Local\Temp\43DA.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\4428.tmp"C:\Users\Admin\AppData\Local\Temp\4428.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\4476.tmp"C:\Users\Admin\AppData\Local\Temp\4476.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\44D4.tmp"C:\Users\Admin\AppData\Local\Temp\44D4.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\4522.tmp"C:\Users\Admin\AppData\Local\Temp\4522.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Users\Admin\AppData\Local\Temp\459F.tmp"C:\Users\Admin\AppData\Local\Temp\459F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\45ED.tmp"C:\Users\Admin\AppData\Local\Temp\45ED.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\464B.tmp"C:\Users\Admin\AppData\Local\Temp\464B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\4699.tmp"C:\Users\Admin\AppData\Local\Temp\4699.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\46F7.tmp"C:\Users\Admin\AppData\Local\Temp\46F7.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\4745.tmp"C:\Users\Admin\AppData\Local\Temp\4745.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\47F1.tmp"C:\Users\Admin\AppData\Local\Temp\47F1.tmp"65⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\483F.tmp"C:\Users\Admin\AppData\Local\Temp\483F.tmp"66⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\488D.tmp"C:\Users\Admin\AppData\Local\Temp\488D.tmp"67⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\48EB.tmp"C:\Users\Admin\AppData\Local\Temp\48EB.tmp"68⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\4958.tmp"C:\Users\Admin\AppData\Local\Temp\4958.tmp"69⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\49A6.tmp"C:\Users\Admin\AppData\Local\Temp\49A6.tmp"70⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\4A14.tmp"C:\Users\Admin\AppData\Local\Temp\4A14.tmp"71⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\4A62.tmp"C:\Users\Admin\AppData\Local\Temp\4A62.tmp"72⤵
- System Location Discovery: System Language Discovery
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"73⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"74⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"75⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"76⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\4C37.tmp"C:\Users\Admin\AppData\Local\Temp\4C37.tmp"77⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\4C85.tmp"C:\Users\Admin\AppData\Local\Temp\4C85.tmp"78⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\4D31.tmp"C:\Users\Admin\AppData\Local\Temp\4D31.tmp"80⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"81⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"82⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"C:\Users\Admin\AppData\Local\Temp\4E3A.tmp"83⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\4E98.tmp"C:\Users\Admin\AppData\Local\Temp\4E98.tmp"84⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"85⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\4F73.tmp"C:\Users\Admin\AppData\Local\Temp\4F73.tmp"86⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"C:\Users\Admin\AppData\Local\Temp\4FD1.tmp"87⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\501F.tmp"C:\Users\Admin\AppData\Local\Temp\501F.tmp"88⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\506D.tmp"C:\Users\Admin\AppData\Local\Temp\506D.tmp"89⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\50F9.tmp"C:\Users\Admin\AppData\Local\Temp\50F9.tmp"90⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\5157.tmp"C:\Users\Admin\AppData\Local\Temp\5157.tmp"91⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\51A5.tmp"C:\Users\Admin\AppData\Local\Temp\51A5.tmp"92⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\51F3.tmp"C:\Users\Admin\AppData\Local\Temp\51F3.tmp"93⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\5242.tmp"C:\Users\Admin\AppData\Local\Temp\5242.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\5290.tmp"C:\Users\Admin\AppData\Local\Temp\5290.tmp"95⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\52DE.tmp"C:\Users\Admin\AppData\Local\Temp\52DE.tmp"96⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\532C.tmp"C:\Users\Admin\AppData\Local\Temp\532C.tmp"97⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\537A.tmp"C:\Users\Admin\AppData\Local\Temp\537A.tmp"98⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\53C8.tmp"C:\Users\Admin\AppData\Local\Temp\53C8.tmp"99⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\5436.tmp"C:\Users\Admin\AppData\Local\Temp\5436.tmp"100⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\5484.tmp"C:\Users\Admin\AppData\Local\Temp\5484.tmp"101⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\54D2.tmp"C:\Users\Admin\AppData\Local\Temp\54D2.tmp"102⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\5530.tmp"C:\Users\Admin\AppData\Local\Temp\5530.tmp"103⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\558D.tmp"C:\Users\Admin\AppData\Local\Temp\558D.tmp"104⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\55EB.tmp"C:\Users\Admin\AppData\Local\Temp\55EB.tmp"105⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\5639.tmp"C:\Users\Admin\AppData\Local\Temp\5639.tmp"106⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\5697.tmp"C:\Users\Admin\AppData\Local\Temp\5697.tmp"107⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\56E5.tmp"C:\Users\Admin\AppData\Local\Temp\56E5.tmp"108⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\5752.tmp"C:\Users\Admin\AppData\Local\Temp\5752.tmp"109⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\57B0.tmp"C:\Users\Admin\AppData\Local\Temp\57B0.tmp"110⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\57FE.tmp"C:\Users\Admin\AppData\Local\Temp\57FE.tmp"111⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\584C.tmp"C:\Users\Admin\AppData\Local\Temp\584C.tmp"112⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"113⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\58E9.tmp"C:\Users\Admin\AppData\Local\Temp\58E9.tmp"114⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\5956.tmp"C:\Users\Admin\AppData\Local\Temp\5956.tmp"115⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"116⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\5A31.tmp"C:\Users\Admin\AppData\Local\Temp\5A31.tmp"117⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\5A8F.tmp"C:\Users\Admin\AppData\Local\Temp\5A8F.tmp"118⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"119⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"120⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"121⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\5C25.tmp"C:\Users\Admin\AppData\Local\Temp\5C25.tmp"122⤵PID:3520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-