Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 08:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_f01b56377f35273dc2d4aafba862b81f_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_f01b56377f35273dc2d4aafba862b81f_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-09_f01b56377f35273dc2d4aafba862b81f_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260809-j8kncatepc
- SHA256 870f46ab2118628d9f735aae211242d18621afe4812c74039cc72037ad196c16
- MD5 f01b56377f35273dc2d4aafba862b81f
- SHA1 fffb2568b5501128b79516eed87a356c3d47502f
- SHA512 9f418b54460bf61e0bd271f8457c8d2582188947ec4d8fc2efa8242b72dc7b826ec1ae4aa6d3ce779a4890ac79cc3e6470cd2a32be11bcc6cd7ec1d6e8c1d1ef
- SSDEEP 12288:wU5rCOTeiDrwahAELmkQnJ29nTJRjmMqPqjdNZ+3/v+I9hUG2VA:wUQOJDr/hA7kB9TJRsSdNGEA
- TLSH T17CE4D12173D88536E6FB037859B5E6614E7EBD325722D6CF2F8015AE09B2BD08670723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3632 17F8.tmp 4508 194F.tmp 844 1A49.tmp 1068 1BD0.tmp 2952 1CDA.tmp 3288 1DD4.tmp 1384 1EFD.tmp 2408 1FE7.tmp 1032 2110.tmp 3856 2219.tmp 5960 22F4.tmp 1772 23EE.tmp 5024 24F8.tmp 2364 2630.tmp 4760 2759.tmp 1200 2853.tmp 3320 296C.tmp 5352 2A57.tmp 4928 2B22.tmp 5496 2BFD.tmp 1608 2CE7.tmp 1264 2DA3.tmp 5360 2E7D.tmp 3912 2F48.tmp 3176 3071.tmp 5992 319A.tmp 5124 32E2.tmp 3720 33EC.tmp 2056 3515.tmp 5808 365D.tmp 3412 3776.tmp 3928 3861.tmp 6032 397A.tmp 5844 3A06.tmp 6092 3AA3.tmp 1908 3B20.tmp 3480 3B9D.tmp 2068 3C29.tmp 2788 3CE5.tmp 3852 3D91.tmp 2008 3E5C.tmp 764 3F17.tmp 2448 3FF2.tmp 5948 408E.tmp 3812 411B.tmp 3456 41A8.tmp 5944 4215.tmp 4756 4292.tmp 440 431F.tmp 3168 437C.tmp 5736 43DA.tmp 4452 4447.tmp 4460 44A5.tmp 4216 4503.tmp 4112 4551.tmp 4428 45ED.tmp 3544 463B.tmp 6108 468A.tmp 4532 46E7.tmp 4236 4735.tmp 1488 4793.tmp 3300 47F1.tmp 2568 483F.tmp 468 488D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F131.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5464.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8846.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4646.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 229.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 847D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 384C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A795.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C186.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D368.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E829.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 313.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 260C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7238.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 720E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 112D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2800.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 766E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3071.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4584 wrote to memory of 3632 4584 2026-08-09_f01b56377f35273dc2d4aafba862b81f_elex_mafia_stealc_tofsee.exe 84 PID 3632 wrote to memory of 4508 3632 17F8.tmp 85 PID 4508 wrote to memory of 844 4508 194F.tmp 86 PID 844 wrote to memory of 1068 844 1A49.tmp 87 PID 1068 wrote to memory of 2952 1068 1BD0.tmp 88 PID 2952 wrote to memory of 3288 2952 1CDA.tmp 89 PID 3288 wrote to memory of 1384 3288 1DD4.tmp 90 PID 1384 wrote to memory of 2408 1384 1EFD.tmp 91 PID 2408 wrote to memory of 1032 2408 1FE7.tmp 92 PID 1032 wrote to memory of 3856 1032 2110.tmp 93 PID 3856 wrote to memory of 5960 3856 2219.tmp 96 PID 5960 wrote to memory of 1772 5960 22F4.tmp 97 PID 1772 wrote to memory of 5024 1772 23EE.tmp 98 PID 5024 wrote to memory of 2364 5024 24F8.tmp 99 PID 2364 wrote to memory of 4760 2364 2630.tmp 101 PID 4760 wrote to memory of 1200 4760 2759.tmp 103 PID 1200 wrote to memory of 3320 1200 2853.tmp 104 PID 3320 wrote to memory of 5352 3320 296C.tmp 105 PID 5352 wrote to memory of 4928 5352 2A57.tmp 106 PID 4928 wrote to memory of 5496 4928 2B22.tmp 109 PID 5496 wrote to memory of 1608 5496 2BFD.tmp 110 PID 1608 wrote to memory of 1264 1608 2CE7.tmp 112 PID 1264 wrote to memory of 5360 1264 2DA3.tmp 113 PID 5360 wrote to memory of 3912 5360 2E7D.tmp 114 PID 3912 wrote to memory of 3176 3912 2F48.tmp 115 PID 3176 wrote to memory of 5992 3176 3071.tmp 116 PID 5992 wrote to memory of 5124 5992 319A.tmp 118 PID 5124 wrote to memory of 3720 5124 32E2.tmp 119 PID 3720 wrote to memory of 2056 3720 33EC.tmp 120 PID 2056 wrote to memory of 5808 2056 3515.tmp 121 PID 5808 wrote to memory of 3412 5808 365D.tmp 122 PID 3412 wrote to memory of 3928 3412 3776.tmp 123 PID 3928 wrote to memory of 6032 3928 3861.tmp 124 PID 6032 wrote to memory of 5844 6032 397A.tmp 125 PID 5844 wrote to memory of 6092 5844 3A06.tmp 126 PID 6092 wrote to memory of 1908 6092 3AA3.tmp 127 PID 1908 wrote to memory of 3480 1908 3B20.tmp 128 PID 3480 wrote to memory of 2068 3480 3B9D.tmp 129 PID 2068 wrote to memory of 2788 2068 3C29.tmp 130 PID 2788 wrote to memory of 3852 2788 3CE5.tmp 131 PID 3852 wrote to memory of 2008 3852 3D91.tmp 132 PID 2008 wrote to memory of 764 2008 3E5C.tmp 134 PID 764 wrote to memory of 2448 764 3F17.tmp 136 PID 2448 wrote to memory of 5948 2448 3FF2.tmp 137 PID 5948 wrote to memory of 3812 5948 408E.tmp 138 PID 3812 wrote to memory of 3456 3812 411B.tmp 139 PID 3456 wrote to memory of 5944 3456 41A8.tmp 140 PID 5944 wrote to memory of 4756 5944 4215.tmp 141 PID 4756 wrote to memory of 440 4756 4292.tmp 142 PID 440 wrote to memory of 3168 440 431F.tmp 143 PID 3168 wrote to memory of 5736 3168 437C.tmp 144 PID 5736 wrote to memory of 4452 5736 43DA.tmp 145 PID 4452 wrote to memory of 4460 4452 4447.tmp 146 PID 4460 wrote to memory of 4216 4460 44A5.tmp 147 PID 4216 wrote to memory of 4112 4216 4503.tmp 148 PID 5468 wrote to memory of 4428 5468 459F.tmp 150 PID 4428 wrote to memory of 3544 4428 45ED.tmp 151 PID 3544 wrote to memory of 6108 3544 463B.tmp 152 PID 6108 wrote to memory of 4532 6108 468A.tmp 153 PID 4532 wrote to memory of 4236 4532 46E7.tmp 154 PID 4236 wrote to memory of 1488 4236 4735.tmp 155 PID 1488 wrote to memory of 3300 1488 4793.tmp 156 PID 3300 wrote to memory of 2568 3300 47F1.tmp 157 PID 2568 wrote to memory of 468 2568 483F.tmp 158
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_f01b56377f35273dc2d4aafba862b81f_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_f01b56377f35273dc2d4aafba862b81f_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\17F8.tmp"C:\Users\Admin\AppData\Local\Temp\17F8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\194F.tmp"C:\Users\Admin\AppData\Local\Temp\194F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\1A49.tmp"C:\Users\Admin\AppData\Local\Temp\1A49.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\2110.tmp"C:\Users\Admin\AppData\Local\Temp\2110.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\2219.tmp"C:\Users\Admin\AppData\Local\Temp\2219.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\22F4.tmp"C:\Users\Admin\AppData\Local\Temp\22F4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\24F8.tmp"C:\Users\Admin\AppData\Local\Temp\24F8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\296C.tmp"C:\Users\Admin\AppData\Local\Temp\296C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\2A57.tmp"C:\Users\Admin\AppData\Local\Temp\2A57.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5352 -
C:\Users\Admin\AppData\Local\Temp\2B22.tmp"C:\Users\Admin\AppData\Local\Temp\2B22.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Users\Admin\AppData\Local\Temp\2F48.tmp"C:\Users\Admin\AppData\Local\Temp\2F48.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\3071.tmp"C:\Users\Admin\AppData\Local\Temp\3071.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\32E2.tmp"C:\Users\Admin\AppData\Local\Temp\32E2.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\3515.tmp"C:\Users\Admin\AppData\Local\Temp\3515.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\365D.tmp"C:\Users\Admin\AppData\Local\Temp\365D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\3861.tmp"C:\Users\Admin\AppData\Local\Temp\3861.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\3A06.tmp"C:\Users\Admin\AppData\Local\Temp\3A06.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Users\Admin\AppData\Local\Temp\3B20.tmp"C:\Users\Admin\AppData\Local\Temp\3B20.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"C:\Users\Admin\AppData\Local\Temp\3B9D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\3C29.tmp"C:\Users\Admin\AppData\Local\Temp\3C29.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\3D91.tmp"C:\Users\Admin\AppData\Local\Temp\3D91.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\3F17.tmp"C:\Users\Admin\AppData\Local\Temp\3F17.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\3FF2.tmp"C:\Users\Admin\AppData\Local\Temp\3FF2.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\408E.tmp"C:\Users\Admin\AppData\Local\Temp\408E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\411B.tmp"C:\Users\Admin\AppData\Local\Temp\411B.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\41A8.tmp"C:\Users\Admin\AppData\Local\Temp\41A8.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\4215.tmp"C:\Users\Admin\AppData\Local\Temp\4215.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\4292.tmp"C:\Users\Admin\AppData\Local\Temp\4292.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\431F.tmp"C:\Users\Admin\AppData\Local\Temp\431F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\437C.tmp"C:\Users\Admin\AppData\Local\Temp\437C.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\43DA.tmp"C:\Users\Admin\AppData\Local\Temp\43DA.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\4447.tmp"C:\Users\Admin\AppData\Local\Temp\4447.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\44A5.tmp"C:\Users\Admin\AppData\Local\Temp\44A5.tmp"54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\4503.tmp"C:\Users\Admin\AppData\Local\Temp\4503.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"56⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\459F.tmp"C:\Users\Admin\AppData\Local\Temp\459F.tmp"57⤵
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Users\Admin\AppData\Local\Temp\45ED.tmp"C:\Users\Admin\AppData\Local\Temp\45ED.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\463B.tmp"C:\Users\Admin\AppData\Local\Temp\463B.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\468A.tmp"C:\Users\Admin\AppData\Local\Temp\468A.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\Temp\46E7.tmp"C:\Users\Admin\AppData\Local\Temp\46E7.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\4735.tmp"C:\Users\Admin\AppData\Local\Temp\4735.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\47F1.tmp"C:\Users\Admin\AppData\Local\Temp\47F1.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\483F.tmp"C:\Users\Admin\AppData\Local\Temp\483F.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\488D.tmp"C:\Users\Admin\AppData\Local\Temp\488D.tmp"66⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\48EB.tmp"C:\Users\Admin\AppData\Local\Temp\48EB.tmp"67⤵PID:6088
-
C:\Users\Admin\AppData\Local\Temp\4939.tmp"C:\Users\Admin\AppData\Local\Temp\4939.tmp"68⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\4987.tmp"C:\Users\Admin\AppData\Local\Temp\4987.tmp"69⤵PID:5680
-
C:\Users\Admin\AppData\Local\Temp\49D5.tmp"C:\Users\Admin\AppData\Local\Temp\49D5.tmp"70⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\4A23.tmp"C:\Users\Admin\AppData\Local\Temp\4A23.tmp"71⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\4A72.tmp"C:\Users\Admin\AppData\Local\Temp\4A72.tmp"72⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"C:\Users\Admin\AppData\Local\Temp\4ACF.tmp"73⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"74⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"75⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"76⤵PID:5284
-
C:\Users\Admin\AppData\Local\Temp\4C17.tmp"C:\Users\Admin\AppData\Local\Temp\4C17.tmp"77⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\4C66.tmp"C:\Users\Admin\AppData\Local\Temp\4C66.tmp"78⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"79⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\4D02.tmp"C:\Users\Admin\AppData\Local\Temp\4D02.tmp"80⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\4D50.tmp"C:\Users\Admin\AppData\Local\Temp\4D50.tmp"81⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"82⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"83⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"84⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"85⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"86⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\4F54.tmp"C:\Users\Admin\AppData\Local\Temp\4F54.tmp"87⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"88⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"89⤵PID:5928
-
C:\Users\Admin\AppData\Local\Temp\504E.tmp"C:\Users\Admin\AppData\Local\Temp\504E.tmp"90⤵PID:5132
-
C:\Users\Admin\AppData\Local\Temp\509C.tmp"C:\Users\Admin\AppData\Local\Temp\509C.tmp"91⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\50EA.tmp"C:\Users\Admin\AppData\Local\Temp\50EA.tmp"92⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\5138.tmp"C:\Users\Admin\AppData\Local\Temp\5138.tmp"93⤵PID:6112
-
C:\Users\Admin\AppData\Local\Temp\5186.tmp"C:\Users\Admin\AppData\Local\Temp\5186.tmp"94⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\51E4.tmp"C:\Users\Admin\AppData\Local\Temp\51E4.tmp"95⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\5232.tmp"C:\Users\Admin\AppData\Local\Temp\5232.tmp"96⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\5280.tmp"C:\Users\Admin\AppData\Local\Temp\5280.tmp"97⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\52DE.tmp"C:\Users\Admin\AppData\Local\Temp\52DE.tmp"98⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\532C.tmp"C:\Users\Admin\AppData\Local\Temp\532C.tmp"99⤵PID:6028
-
C:\Users\Admin\AppData\Local\Temp\537A.tmp"C:\Users\Admin\AppData\Local\Temp\537A.tmp"100⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\53C8.tmp"C:\Users\Admin\AppData\Local\Temp\53C8.tmp"101⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\5416.tmp"C:\Users\Admin\AppData\Local\Temp\5416.tmp"102⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\5464.tmp"C:\Users\Admin\AppData\Local\Temp\5464.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\54B3.tmp"C:\Users\Admin\AppData\Local\Temp\54B3.tmp"104⤵PID:5292
-
C:\Users\Admin\AppData\Local\Temp\5530.tmp"C:\Users\Admin\AppData\Local\Temp\5530.tmp"105⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\557E.tmp"C:\Users\Admin\AppData\Local\Temp\557E.tmp"106⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\55CC.tmp"C:\Users\Admin\AppData\Local\Temp\55CC.tmp"107⤵PID:5400
-
C:\Users\Admin\AppData\Local\Temp\561A.tmp"C:\Users\Admin\AppData\Local\Temp\561A.tmp"108⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\5668.tmp"C:\Users\Admin\AppData\Local\Temp\5668.tmp"109⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\56B6.tmp"C:\Users\Admin\AppData\Local\Temp\56B6.tmp"110⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\5704.tmp"C:\Users\Admin\AppData\Local\Temp\5704.tmp"111⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\5752.tmp"C:\Users\Admin\AppData\Local\Temp\5752.tmp"112⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\57A1.tmp"C:\Users\Admin\AppData\Local\Temp\57A1.tmp"113⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\57EF.tmp"C:\Users\Admin\AppData\Local\Temp\57EF.tmp"114⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\583D.tmp"C:\Users\Admin\AppData\Local\Temp\583D.tmp"115⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\589B.tmp"C:\Users\Admin\AppData\Local\Temp\589B.tmp"116⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\58E9.tmp"C:\Users\Admin\AppData\Local\Temp\58E9.tmp"117⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\5937.tmp"C:\Users\Admin\AppData\Local\Temp\5937.tmp"118⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\5985.tmp"C:\Users\Admin\AppData\Local\Temp\5985.tmp"119⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\59D3.tmp"C:\Users\Admin\AppData\Local\Temp\59D3.tmp"120⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"121⤵PID:6004
-
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:2204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-