Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/08/2026, 05:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-06_b3e9624d10ba6858b6769436662c8020_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_b3e9624d10ba6858b6769436662c8020_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-06_b3e9624d10ba6858b6769436662c8020_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260806-fwve8stema
- SHA256 4aff8bc3230557e61998eb1551adfe87c6ef5045024606a9801aeb91a280310e
- MD5 b3e9624d10ba6858b6769436662c8020
- SHA1 46bb2ec5cd5ddfa32864b7166092ec0fa028ffdb
- SHA512 2dc5b4bce4184cef7c247b20d40e1354f8d47914c91688b4e29e4705251d4cabddd2315edde794ad456c6b70dc4c7d4d2b8b5f84c6e797fd19e96870f440a37f
- SSDEEP 12288:NU5rCOTeijqX01ktZAoLsdJm4QXIQXPTZwlH4Hp:NUQOJjqXhzAyCF56PTSlH4Hp
- TLSH T127B4F126B685C233D29202311ADADFE16E3BBC71572694C33B94632D2BB16E1D376347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 464 F9B.tmp 3868 1037.tmp 4952 10C4.tmp 864 118F.tmp 4476 123B.tmp 1616 12C8.tmp 2880 1345.tmp 4328 13D1.tmp 1232 147D.tmp 3324 1529.tmp 2148 15F4.tmp 4044 1690.tmp 3840 170D.tmp 4056 17B9.tmp 2248 1875.tmp 2244 1911.tmp 4140 19CC.tmp 2052 1A69.tmp 4832 1B15.tmp 3872 1BD0.tmp 4908 1C7C.tmp 4448 1D28.tmp 2220 1DE3.tmp 2980 1EBE.tmp 3620 1F6A.tmp 4264 1FE7.tmp 4404 2083.tmp 4128 212F.tmp 2384 21DB.tmp 4556 2296.tmp 5096 2323.tmp 2356 2381.tmp 2968 243C.tmp 220 24AA.tmp 4232 24F8.tmp 5016 2565.tmp 2144 25B3.tmp 3252 2630.tmp 2300 267E.tmp 2604 26DC.tmp 3796 272A.tmp 3552 2788.tmp 2952 27D6.tmp 2460 2834.tmp 3600 2882.tmp 1092 28E0.tmp 3268 293E.tmp 3808 298C.tmp 4828 29DA.tmp 2100 2A28.tmp 4316 2A76.tmp 1640 2AC4.tmp 4512 2B22.tmp 2004 2B70.tmp 3204 2BCE.tmp 3848 2C1C.tmp 4292 2C6A.tmp 3328 2CC8.tmp 4460 2D26.tmp 3628 2D74.tmp 3536 2DC2.tmp 4924 2E20.tmp 704 2E6E.tmp 1244 2EBC.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F99D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 313.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9219.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D712.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2788.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F121.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 742C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7356.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A97A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C723.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 410B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D983.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7303.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 701A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 968E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7078.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 915E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4704 wrote to memory of 464 4704 2026-08-06_b3e9624d10ba6858b6769436662c8020_elex_mafia_stealc_tofsee.exe 85 PID 464 wrote to memory of 3868 464 F9B.tmp 86 PID 3868 wrote to memory of 4952 3868 1037.tmp 87 PID 4952 wrote to memory of 864 4952 10C4.tmp 88 PID 864 wrote to memory of 4476 864 118F.tmp 89 PID 4476 wrote to memory of 1616 4476 123B.tmp 90 PID 1616 wrote to memory of 2880 1616 12C8.tmp 91 PID 2880 wrote to memory of 4328 2880 1345.tmp 92 PID 4328 wrote to memory of 1232 4328 13D1.tmp 93 PID 1232 wrote to memory of 3324 1232 147D.tmp 94 PID 3324 wrote to memory of 2148 3324 1529.tmp 95 PID 2148 wrote to memory of 4044 2148 15F4.tmp 96 PID 4044 wrote to memory of 3840 4044 1690.tmp 97 PID 3840 wrote to memory of 4056 3840 170D.tmp 98 PID 4056 wrote to memory of 2248 4056 17B9.tmp 99 PID 2248 wrote to memory of 2244 2248 1875.tmp 100 PID 2244 wrote to memory of 4140 2244 1911.tmp 101 PID 4140 wrote to memory of 2052 4140 19CC.tmp 102 PID 2052 wrote to memory of 4832 2052 1A69.tmp 103 PID 4832 wrote to memory of 3872 4832 1B15.tmp 104 PID 3872 wrote to memory of 4908 3872 1BD0.tmp 105 PID 4908 wrote to memory of 4448 4908 1C7C.tmp 106 PID 4448 wrote to memory of 2220 4448 1D28.tmp 107 PID 2220 wrote to memory of 2980 2220 1DE3.tmp 108 PID 2980 wrote to memory of 3620 2980 1EBE.tmp 109 PID 3620 wrote to memory of 4264 3620 1F6A.tmp 110 PID 4264 wrote to memory of 4404 4264 1FE7.tmp 111 PID 4404 wrote to memory of 4128 4404 2083.tmp 112 PID 4128 wrote to memory of 2384 4128 212F.tmp 113 PID 2384 wrote to memory of 4556 2384 21DB.tmp 114 PID 4556 wrote to memory of 5096 4556 2296.tmp 115 PID 5096 wrote to memory of 2356 5096 2323.tmp 116 PID 2356 wrote to memory of 2968 2356 2381.tmp 117 PID 2968 wrote to memory of 220 2968 243C.tmp 118 PID 220 wrote to memory of 4232 220 24AA.tmp 119 PID 4232 wrote to memory of 5016 4232 24F8.tmp 120 PID 5016 wrote to memory of 2144 5016 2565.tmp 121 PID 2144 wrote to memory of 3252 2144 25B3.tmp 122 PID 3252 wrote to memory of 2300 3252 2630.tmp 123 PID 2300 wrote to memory of 2604 2300 267E.tmp 124 PID 2604 wrote to memory of 3796 2604 26DC.tmp 125 PID 3796 wrote to memory of 3552 3796 272A.tmp 126 PID 3552 wrote to memory of 2952 3552 2788.tmp 127 PID 2952 wrote to memory of 2460 2952 27D6.tmp 128 PID 2460 wrote to memory of 3600 2460 2834.tmp 129 PID 3600 wrote to memory of 1092 3600 2882.tmp 130 PID 1092 wrote to memory of 3268 1092 28E0.tmp 131 PID 3268 wrote to memory of 3808 3268 293E.tmp 132 PID 3808 wrote to memory of 4828 3808 298C.tmp 133 PID 4828 wrote to memory of 2100 4828 29DA.tmp 134 PID 2100 wrote to memory of 4316 2100 2A28.tmp 135 PID 4316 wrote to memory of 1640 4316 2A76.tmp 136 PID 1640 wrote to memory of 4512 1640 2AC4.tmp 137 PID 4512 wrote to memory of 2004 4512 2B22.tmp 138 PID 2004 wrote to memory of 3204 2004 2B70.tmp 139 PID 3204 wrote to memory of 3848 3204 2BCE.tmp 140 PID 3848 wrote to memory of 4292 3848 2C1C.tmp 141 PID 4292 wrote to memory of 3328 4292 2C6A.tmp 142 PID 3328 wrote to memory of 4460 3328 2CC8.tmp 143 PID 4460 wrote to memory of 3628 4460 2D26.tmp 144 PID 3628 wrote to memory of 3536 3628 2D74.tmp 145 PID 3536 wrote to memory of 4924 3536 2DC2.tmp 146 PID 4924 wrote to memory of 704 4924 2E20.tmp 147 PID 704 wrote to memory of 1244 704 2E6E.tmp 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b3e9624d10ba6858b6769436662c8020_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_b3e9624d10ba6858b6769436662c8020_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\1037.tmp"C:\Users\Admin\AppData\Local\Temp\1037.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\118F.tmp"C:\Users\Admin\AppData\Local\Temp\118F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\123B.tmp"C:\Users\Admin\AppData\Local\Temp\123B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\12C8.tmp"C:\Users\Admin\AppData\Local\Temp\12C8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\1345.tmp"C:\Users\Admin\AppData\Local\Temp\1345.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\1529.tmp"C:\Users\Admin\AppData\Local\Temp\1529.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\170D.tmp"C:\Users\Admin\AppData\Local\Temp\170D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\17B9.tmp"C:\Users\Admin\AppData\Local\Temp\17B9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\1911.tmp"C:\Users\Admin\AppData\Local\Temp\1911.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\19CC.tmp"C:\Users\Admin\AppData\Local\Temp\19CC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\1B15.tmp"C:\Users\Admin\AppData\Local\Temp\1B15.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"C:\Users\Admin\AppData\Local\Temp\1C7C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\1D28.tmp"C:\Users\Admin\AppData\Local\Temp\1D28.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"C:\Users\Admin\AppData\Local\Temp\1EBE.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\2083.tmp"C:\Users\Admin\AppData\Local\Temp\2083.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\212F.tmp"C:\Users\Admin\AppData\Local\Temp\212F.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\21DB.tmp"C:\Users\Admin\AppData\Local\Temp\21DB.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\2296.tmp"C:\Users\Admin\AppData\Local\Temp\2296.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\2381.tmp"C:\Users\Admin\AppData\Local\Temp\2381.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\243C.tmp"C:\Users\Admin\AppData\Local\Temp\243C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\24AA.tmp"C:\Users\Admin\AppData\Local\Temp\24AA.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\24F8.tmp"C:\Users\Admin\AppData\Local\Temp\24F8.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\25B3.tmp"C:\Users\Admin\AppData\Local\Temp\25B3.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\267E.tmp"C:\Users\Admin\AppData\Local\Temp\267E.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\26DC.tmp"C:\Users\Admin\AppData\Local\Temp\26DC.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\272A.tmp"C:\Users\Admin\AppData\Local\Temp\272A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\27D6.tmp"C:\Users\Admin\AppData\Local\Temp\27D6.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\2882.tmp"C:\Users\Admin\AppData\Local\Temp\2882.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\28E0.tmp"C:\Users\Admin\AppData\Local\Temp\28E0.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\293E.tmp"C:\Users\Admin\AppData\Local\Temp\293E.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\298C.tmp"C:\Users\Admin\AppData\Local\Temp\298C.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\29DA.tmp"C:\Users\Admin\AppData\Local\Temp\29DA.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\2A28.tmp"C:\Users\Admin\AppData\Local\Temp\2A28.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\2A76.tmp"C:\Users\Admin\AppData\Local\Temp\2A76.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\2B70.tmp"C:\Users\Admin\AppData\Local\Temp\2B70.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\2C6A.tmp"C:\Users\Admin\AppData\Local\Temp\2C6A.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\2D26.tmp"C:\Users\Admin\AppData\Local\Temp\2D26.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\2D74.tmp"C:\Users\Admin\AppData\Local\Temp\2D74.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\2E20.tmp"C:\Users\Admin\AppData\Local\Temp\2E20.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"65⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"66⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\2F77.tmp"C:\Users\Admin\AppData\Local\Temp\2F77.tmp"67⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"C:\Users\Admin\AppData\Local\Temp\2FC5.tmp"68⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\3014.tmp"C:\Users\Admin\AppData\Local\Temp\3014.tmp"69⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\3062.tmp"C:\Users\Admin\AppData\Local\Temp\3062.tmp"70⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\30B0.tmp"C:\Users\Admin\AppData\Local\Temp\30B0.tmp"71⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\30FE.tmp"C:\Users\Admin\AppData\Local\Temp\30FE.tmp"72⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\314C.tmp"C:\Users\Admin\AppData\Local\Temp\314C.tmp"73⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"74⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\31F8.tmp"C:\Users\Admin\AppData\Local\Temp\31F8.tmp"75⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\3246.tmp"C:\Users\Admin\AppData\Local\Temp\3246.tmp"76⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\3294.tmp"C:\Users\Admin\AppData\Local\Temp\3294.tmp"77⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"78⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"79⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"80⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"81⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\3479.tmp"C:\Users\Admin\AppData\Local\Temp\3479.tmp"82⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"83⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\3544.tmp"C:\Users\Admin\AppData\Local\Temp\3544.tmp"84⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\35B1.tmp"C:\Users\Admin\AppData\Local\Temp\35B1.tmp"85⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\35FF.tmp"C:\Users\Admin\AppData\Local\Temp\35FF.tmp"86⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\364D.tmp"C:\Users\Admin\AppData\Local\Temp\364D.tmp"87⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\36AB.tmp"C:\Users\Admin\AppData\Local\Temp\36AB.tmp"88⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\3718.tmp"C:\Users\Admin\AppData\Local\Temp\3718.tmp"89⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\3767.tmp"C:\Users\Admin\AppData\Local\Temp\3767.tmp"90⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"91⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\3822.tmp"C:\Users\Admin\AppData\Local\Temp\3822.tmp"92⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\3870.tmp"C:\Users\Admin\AppData\Local\Temp\3870.tmp"93⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"94⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\391C.tmp"C:\Users\Admin\AppData\Local\Temp\391C.tmp"95⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"96⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\39B8.tmp"C:\Users\Admin\AppData\Local\Temp\39B8.tmp"97⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\3A06.tmp"C:\Users\Admin\AppData\Local\Temp\3A06.tmp"98⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\3A55.tmp"C:\Users\Admin\AppData\Local\Temp\3A55.tmp"99⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"100⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\3B10.tmp"C:\Users\Admin\AppData\Local\Temp\3B10.tmp"101⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"102⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"103⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"104⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\3C68.tmp"C:\Users\Admin\AppData\Local\Temp\3C68.tmp"105⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"106⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\3D14.tmp"C:\Users\Admin\AppData\Local\Temp\3D14.tmp"107⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\3D62.tmp"C:\Users\Admin\AppData\Local\Temp\3D62.tmp"108⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\3DB0.tmp"C:\Users\Admin\AppData\Local\Temp\3DB0.tmp"109⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"110⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\3E8B.tmp"C:\Users\Admin\AppData\Local\Temp\3E8B.tmp"111⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"C:\Users\Admin\AppData\Local\Temp\3EF8.tmp"112⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\3F65.tmp"C:\Users\Admin\AppData\Local\Temp\3F65.tmp"113⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"114⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\4021.tmp"C:\Users\Admin\AppData\Local\Temp\4021.tmp"115⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\406F.tmp"C:\Users\Admin\AppData\Local\Temp\406F.tmp"116⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\40BD.tmp"C:\Users\Admin\AppData\Local\Temp\40BD.tmp"117⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\410B.tmp"C:\Users\Admin\AppData\Local\Temp\410B.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\4179.tmp"C:\Users\Admin\AppData\Local\Temp\4179.tmp"119⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\41D6.tmp"C:\Users\Admin\AppData\Local\Temp\41D6.tmp"120⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\4234.tmp"C:\Users\Admin\AppData\Local\Temp\4234.tmp"121⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\42A2.tmp"C:\Users\Admin\AppData\Local\Temp\42A2.tmp"122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-