Analysis
- max time kernel
150s - max time network
117s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/08/2026, 02:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_dc6281bb7827e0e443fcd1c5fa759dc1_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_dc6281bb7827e0e443fcd1c5fa759dc1_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-05_dc6281bb7827e0e443fcd1c5fa759dc1_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260805-c8wx2styfz
- SHA256 0fe238306b04baa5517e85399ac68632afb409acf74a6b23ce81d2f089d8fbfe
- MD5 dc6281bb7827e0e443fcd1c5fa759dc1
- SHA1 f72900563597fdacd973875cedc10315d310b0cd
- SHA512 7cb9986bd062ef63a5fb9fd04d2ed8ba1ac97302223aac3790383956f202145dc231617e59b0c6030773cf6d982450cb8c8abee684d03a8e3b03193d353a589a
- SSDEEP 12288:NU5rCOTeijT8o4oBRuSldndF5N5RTZwlH4Hp:NUQOJjT8wBAoZRlTSlH4Hp
- TLSH T183B4F125B249C232E69202311FD6EBE26A3BBD75532690C33B94A27D2B717E1D375343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4008 243C.tmp 648 24E8.tmp 4420 2584.tmp 2028 2650.tmp 4888 26EC.tmp 1444 2778.tmp 5000 2805.tmp 3088 2882.tmp 2604 291E.tmp 4588 29BB.tmp 4020 2A76.tmp 4384 2B32.tmp 3496 2BED.tmp 3864 2C4B.tmp 3884 2CD7.tmp 4648 2D93.tmp 4708 2E2F.tmp 3544 2EEB.tmp 4108 2FA6.tmp 2472 3042.tmp 5016 30EE.tmp 2568 318B.tmp 2092 3217.tmp 3796 3285.tmp 4928 3330.tmp 2524 33CD.tmp 4364 344A.tmp 3424 34E6.tmp 4944 3582.tmp 1160 361E.tmp 920 36CA.tmp 2996 3738.tmp 3548 37B5.tmp 2872 3812.tmp 2128 3870.tmp 1564 38CE.tmp 1056 391C.tmp 5052 397A.tmp 536 39E7.tmp 936 3A35.tmp 1304 3AA3.tmp 1236 3B00.tmp 3252 3B4F.tmp 1356 3BAC.tmp 1996 3BFA.tmp 4848 3C49.tmp 2376 3C97.tmp 3516 3CE5.tmp 2820 3D43.tmp 2732 3DA0.tmp 3248 3DEE.tmp 3208 3E4C.tmp 2452 3EAA.tmp 1800 3F17.tmp 720 3F65.tmp 3396 3FC3.tmp 988 4021.tmp 4464 406F.tmp 4768 40DC.tmp 1240 413A.tmp 900 4188.tmp 1756 41F6.tmp 5064 4244.tmp 4280 42A2.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2650.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ACF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A841.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 239B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 960C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A40.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 211B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B244.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B34D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E29B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_dc6281bb7827e0e443fcd1c5fa759dc1_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5087.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4308 wrote to memory of 4008 4308 2026-08-05_dc6281bb7827e0e443fcd1c5fa759dc1_elex_mafia_stealc_tofsee.exe 85 PID 4008 wrote to memory of 648 4008 243C.tmp 86 PID 648 wrote to memory of 4420 648 24E8.tmp 87 PID 4420 wrote to memory of 2028 4420 2584.tmp 88 PID 2028 wrote to memory of 4888 2028 2650.tmp 89 PID 4888 wrote to memory of 1444 4888 26EC.tmp 90 PID 1444 wrote to memory of 5000 1444 2778.tmp 91 PID 5000 wrote to memory of 3088 5000 2805.tmp 92 PID 3088 wrote to memory of 2604 3088 2882.tmp 93 PID 2604 wrote to memory of 4588 2604 291E.tmp 94 PID 4588 wrote to memory of 4020 4588 29BB.tmp 95 PID 4020 wrote to memory of 4384 4020 2A76.tmp 96 PID 4384 wrote to memory of 3496 4384 2B32.tmp 97 PID 3496 wrote to memory of 3864 3496 2BED.tmp 98 PID 3864 wrote to memory of 3884 3864 2C4B.tmp 99 PID 3884 wrote to memory of 4648 3884 2CD7.tmp 100 PID 4648 wrote to memory of 4708 4648 2D93.tmp 101 PID 4708 wrote to memory of 3544 4708 2E2F.tmp 102 PID 3544 wrote to memory of 4108 3544 2EEB.tmp 103 PID 4108 wrote to memory of 2472 4108 2FA6.tmp 104 PID 2472 wrote to memory of 5016 2472 3042.tmp 105 PID 5016 wrote to memory of 2568 5016 30EE.tmp 106 PID 2568 wrote to memory of 2092 2568 318B.tmp 107 PID 2092 wrote to memory of 3796 2092 3217.tmp 108 PID 3796 wrote to memory of 4928 3796 3285.tmp 109 PID 4928 wrote to memory of 2524 4928 3330.tmp 110 PID 2524 wrote to memory of 4364 2524 33CD.tmp 111 PID 4364 wrote to memory of 3424 4364 344A.tmp 112 PID 3424 wrote to memory of 4944 3424 34E6.tmp 113 PID 4944 wrote to memory of 1160 4944 3582.tmp 114 PID 1160 wrote to memory of 920 1160 361E.tmp 115 PID 920 wrote to memory of 2996 920 36CA.tmp 116 PID 2996 wrote to memory of 3548 2996 3738.tmp 117 PID 3548 wrote to memory of 2872 3548 37B5.tmp 118 PID 2872 wrote to memory of 2128 2872 3812.tmp 119 PID 2128 wrote to memory of 1564 2128 3870.tmp 120 PID 1564 wrote to memory of 1056 1564 38CE.tmp 121 PID 1056 wrote to memory of 5052 1056 391C.tmp 122 PID 5052 wrote to memory of 536 5052 397A.tmp 123 PID 536 wrote to memory of 936 536 39E7.tmp 124 PID 936 wrote to memory of 1304 936 3A35.tmp 125 PID 1304 wrote to memory of 1236 1304 3AA3.tmp 126 PID 1236 wrote to memory of 3252 1236 3B00.tmp 127 PID 3252 wrote to memory of 1356 3252 3B4F.tmp 128 PID 1356 wrote to memory of 1996 1356 3BAC.tmp 129 PID 1996 wrote to memory of 4848 1996 3BFA.tmp 130 PID 4848 wrote to memory of 2376 4848 3C49.tmp 131 PID 2376 wrote to memory of 3516 2376 3C97.tmp 132 PID 3516 wrote to memory of 2820 3516 3CE5.tmp 133 PID 2820 wrote to memory of 2732 2820 3D43.tmp 134 PID 2732 wrote to memory of 3248 2732 3DA0.tmp 135 PID 3248 wrote to memory of 3208 3248 3DEE.tmp 136 PID 3208 wrote to memory of 2452 3208 3E4C.tmp 137 PID 2452 wrote to memory of 1800 2452 3EAA.tmp 138 PID 1800 wrote to memory of 720 1800 3F17.tmp 139 PID 720 wrote to memory of 3396 720 3F65.tmp 140 PID 3396 wrote to memory of 988 3396 3FC3.tmp 141 PID 988 wrote to memory of 4464 988 4021.tmp 142 PID 4464 wrote to memory of 4768 4464 406F.tmp 143 PID 4768 wrote to memory of 1240 4768 40DC.tmp 144 PID 1240 wrote to memory of 900 1240 413A.tmp 145 PID 900 wrote to memory of 1756 900 4188.tmp 146 PID 1756 wrote to memory of 5064 1756 41F6.tmp 147 PID 5064 wrote to memory of 4280 5064 4244.tmp 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_dc6281bb7827e0e443fcd1c5fa759dc1_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_dc6281bb7827e0e443fcd1c5fa759dc1_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\243C.tmp"C:\Users\Admin\AppData\Local\Temp\243C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\2584.tmp"C:\Users\Admin\AppData\Local\Temp\2584.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\2650.tmp"C:\Users\Admin\AppData\Local\Temp\2650.tmp"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\26EC.tmp"C:\Users\Admin\AppData\Local\Temp\26EC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\2778.tmp"C:\Users\Admin\AppData\Local\Temp\2778.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\2805.tmp"C:\Users\Admin\AppData\Local\Temp\2805.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\2882.tmp"C:\Users\Admin\AppData\Local\Temp\2882.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\291E.tmp"C:\Users\Admin\AppData\Local\Temp\291E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\29BB.tmp"C:\Users\Admin\AppData\Local\Temp\29BB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\2A76.tmp"C:\Users\Admin\AppData\Local\Temp\2A76.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\2B32.tmp"C:\Users\Admin\AppData\Local\Temp\2B32.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\2BED.tmp"C:\Users\Admin\AppData\Local\Temp\2BED.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\2D93.tmp"C:\Users\Admin\AppData\Local\Temp\2D93.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"C:\Users\Admin\AppData\Local\Temp\2E2F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\3042.tmp"C:\Users\Admin\AppData\Local\Temp\3042.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\318B.tmp"C:\Users\Admin\AppData\Local\Temp\318B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\3217.tmp"C:\Users\Admin\AppData\Local\Temp\3217.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\3330.tmp"C:\Users\Admin\AppData\Local\Temp\3330.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\36CA.tmp"C:\Users\Admin\AppData\Local\Temp\36CA.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\3738.tmp"C:\Users\Admin\AppData\Local\Temp\3738.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\3812.tmp"C:\Users\Admin\AppData\Local\Temp\3812.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\3870.tmp"C:\Users\Admin\AppData\Local\Temp\3870.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\391C.tmp"C:\Users\Admin\AppData\Local\Temp\391C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\39E7.tmp"C:\Users\Admin\AppData\Local\Temp\39E7.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\3A35.tmp"C:\Users\Admin\AppData\Local\Temp\3A35.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\3B00.tmp"C:\Users\Admin\AppData\Local\Temp\3B00.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\3C49.tmp"C:\Users\Admin\AppData\Local\Temp\3C49.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\3C97.tmp"C:\Users\Admin\AppData\Local\Temp\3C97.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\3D43.tmp"C:\Users\Admin\AppData\Local\Temp\3D43.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"C:\Users\Admin\AppData\Local\Temp\3DEE.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"C:\Users\Admin\AppData\Local\Temp\3E4C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\3F17.tmp"C:\Users\Admin\AppData\Local\Temp\3F17.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\3F65.tmp"C:\Users\Admin\AppData\Local\Temp\3F65.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\4021.tmp"C:\Users\Admin\AppData\Local\Temp\4021.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\406F.tmp"C:\Users\Admin\AppData\Local\Temp\406F.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\40DC.tmp"C:\Users\Admin\AppData\Local\Temp\40DC.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\413A.tmp"C:\Users\Admin\AppData\Local\Temp\413A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\4188.tmp"C:\Users\Admin\AppData\Local\Temp\4188.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\41F6.tmp"C:\Users\Admin\AppData\Local\Temp\41F6.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\4244.tmp"C:\Users\Admin\AppData\Local\Temp\4244.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"65⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\42FF.tmp"C:\Users\Admin\AppData\Local\Temp\42FF.tmp"66⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\435D.tmp"C:\Users\Admin\AppData\Local\Temp\435D.tmp"67⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\43AB.tmp"C:\Users\Admin\AppData\Local\Temp\43AB.tmp"68⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\43F9.tmp"C:\Users\Admin\AppData\Local\Temp\43F9.tmp"69⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\4457.tmp"C:\Users\Admin\AppData\Local\Temp\4457.tmp"70⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\44A5.tmp"C:\Users\Admin\AppData\Local\Temp\44A5.tmp"71⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\4503.tmp"C:\Users\Admin\AppData\Local\Temp\4503.tmp"72⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\4561.tmp"C:\Users\Admin\AppData\Local\Temp\4561.tmp"73⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\45BE.tmp"C:\Users\Admin\AppData\Local\Temp\45BE.tmp"74⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\460D.tmp"C:\Users\Admin\AppData\Local\Temp\460D.tmp"75⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\466A.tmp"C:\Users\Admin\AppData\Local\Temp\466A.tmp"76⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\46B8.tmp"C:\Users\Admin\AppData\Local\Temp\46B8.tmp"77⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\4707.tmp"C:\Users\Admin\AppData\Local\Temp\4707.tmp"78⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\4764.tmp"C:\Users\Admin\AppData\Local\Temp\4764.tmp"79⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\47B2.tmp"C:\Users\Admin\AppData\Local\Temp\47B2.tmp"80⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\4820.tmp"C:\Users\Admin\AppData\Local\Temp\4820.tmp"81⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\488D.tmp"C:\Users\Admin\AppData\Local\Temp\488D.tmp"82⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\48DB.tmp"C:\Users\Admin\AppData\Local\Temp\48DB.tmp"83⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\4949.tmp"C:\Users\Admin\AppData\Local\Temp\4949.tmp"84⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\49A6.tmp"C:\Users\Admin\AppData\Local\Temp\49A6.tmp"85⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\4A04.tmp"C:\Users\Admin\AppData\Local\Temp\4A04.tmp"86⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\4A62.tmp"C:\Users\Admin\AppData\Local\Temp\4A62.tmp"87⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"88⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"89⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"90⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\4C27.tmp"C:\Users\Admin\AppData\Local\Temp\4C27.tmp"92⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\4C94.tmp"C:\Users\Admin\AppData\Local\Temp\4C94.tmp"93⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"94⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\4D50.tmp"C:\Users\Admin\AppData\Local\Temp\4D50.tmp"95⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"96⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"97⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\4E79.tmp"C:\Users\Admin\AppData\Local\Temp\4E79.tmp"98⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\4EC7.tmp"C:\Users\Admin\AppData\Local\Temp\4EC7.tmp"99⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\4F15.tmp"C:\Users\Admin\AppData\Local\Temp\4F15.tmp"100⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\4F63.tmp"C:\Users\Admin\AppData\Local\Temp\4F63.tmp"101⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"102⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\500F.tmp"C:\Users\Admin\AppData\Local\Temp\500F.tmp"103⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\506D.tmp"C:\Users\Admin\AppData\Local\Temp\506D.tmp"104⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\50DA.tmp"C:\Users\Admin\AppData\Local\Temp\50DA.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\5128.tmp"C:\Users\Admin\AppData\Local\Temp\5128.tmp"106⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\5186.tmp"C:\Users\Admin\AppData\Local\Temp\5186.tmp"107⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\51D4.tmp"C:\Users\Admin\AppData\Local\Temp\51D4.tmp"108⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\5222.tmp"C:\Users\Admin\AppData\Local\Temp\5222.tmp"109⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\5290.tmp"C:\Users\Admin\AppData\Local\Temp\5290.tmp"110⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\52DE.tmp"C:\Users\Admin\AppData\Local\Temp\52DE.tmp"111⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\533C.tmp"C:\Users\Admin\AppData\Local\Temp\533C.tmp"112⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"113⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\53E7.tmp"C:\Users\Admin\AppData\Local\Temp\53E7.tmp"114⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\5455.tmp"C:\Users\Admin\AppData\Local\Temp\5455.tmp"115⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\54A3.tmp"C:\Users\Admin\AppData\Local\Temp\54A3.tmp"116⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\54F1.tmp"C:\Users\Admin\AppData\Local\Temp\54F1.tmp"117⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\554F.tmp"C:\Users\Admin\AppData\Local\Temp\554F.tmp"118⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\55AD.tmp"C:\Users\Admin\AppData\Local\Temp\55AD.tmp"119⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\55FB.tmp"C:\Users\Admin\AppData\Local\Temp\55FB.tmp"120⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\5649.tmp"C:\Users\Admin\AppData\Local\Temp\5649.tmp"121⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\56B6.tmp"C:\Users\Admin\AppData\Local\Temp\56B6.tmp"122⤵PID:4856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-