Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 23:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_e081117c337e611ee6948ad8b776adb2_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_e081117c337e611ee6948ad8b776adb2_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-10_e081117c337e611ee6948ad8b776adb2_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260810-3eqr2sbb74
- SHA256 9a31f0c7a891b82175bf825e7de09d587a0b135f996619581aed566fa5e20c74
- MD5 e081117c337e611ee6948ad8b776adb2
- SHA1 8937bd475f52f9130c331d155e1a25acfd22cccc
- SHA512 9d50601bce469aa4fff39629d6ab99d63c55e704e4ee571a9c7d17b54c06e579b5e6e487e37ff22f1679653856974373bec101baf3be810f72ac00f4fffea437
- SSDEEP 12288:wU5rCOTeiDsDb2ba+t1InNvU8O0Lc68Zy8R0NZ+3/v+I9hUG2VA:wUQOJDsDbx+t1InttLc68Zy8aNGEA
- TLSH T197E4D02173D88532E5FB037859B5E6614D7EBD326722D6CF2F9025AE09B1BC09A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3248 10C4.tmp 4612 122B.tmp 2280 1335.tmp 3908 145E.tmp 4616 1567.tmp 2028 1661.tmp 1064 174C.tmp 3000 1827.tmp 4944 194F.tmp 1468 1A2A.tmp 2468 1B24.tmp 3308 1BD0.tmp 3016 1CE9.tmp 4680 1DD4.tmp 3144 1EAE.tmp 4036 1FA8.tmp 772 20D1.tmp 4808 21DB.tmp 2528 22C5.tmp 1788 23DF.tmp 3200 24E8.tmp 4572 2601.tmp 1016 272A.tmp 2408 2834.tmp 456 291E.tmp 416 29E9.tmp 1232 2AE3.tmp 4172 2BBE.tmp 1680 2CB8.tmp 1924 2DB2.tmp 736 2E9D.tmp 4088 2F87.tmp 4472 3081.tmp 2400 311D.tmp 4164 31B9.tmp 1084 3246.tmp 2604 32C3.tmp 5028 3350.tmp 3964 33FC.tmp 880 3498.tmp 4264 3553.tmp 2420 35F0.tmp 4368 368C.tmp 1852 3718.tmp 2356 37B5.tmp 1288 3851.tmp 3004 38DE.tmp 4244 396A.tmp 4636 39F7.tmp 2828 3A45.tmp 4056 3AC2.tmp 4000 3B10.tmp 3968 3B7D.tmp 2660 3BDB.tmp 2428 3C29.tmp 4548 3C87.tmp 3936 3D04.tmp 4188 3D81.tmp 1180 3DDF.tmp 4828 3E3D.tmp 3148 3EAA.tmp 3488 3F37.tmp 2480 3FB4.tmp 1160 4021.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7133.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8708.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 913A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 431A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 174C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2188.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 603C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5445.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C09C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F577.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 765F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 967A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4726.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D126.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5927.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A207.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B783.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2793.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1ED.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2448 wrote to memory of 3248 2448 2026-08-10_e081117c337e611ee6948ad8b776adb2_elex_mafia_stealc_tofsee.exe 85 PID 3248 wrote to memory of 4612 3248 10C4.tmp 86 PID 4612 wrote to memory of 2280 4612 122B.tmp 87 PID 2280 wrote to memory of 3908 2280 1335.tmp 88 PID 3908 wrote to memory of 4616 3908 145E.tmp 89 PID 4616 wrote to memory of 2028 4616 1567.tmp 90 PID 2028 wrote to memory of 1064 2028 1661.tmp 91 PID 1064 wrote to memory of 3000 1064 174C.tmp 92 PID 3000 wrote to memory of 4944 3000 1827.tmp 93 PID 4944 wrote to memory of 1468 4944 194F.tmp 94 PID 1468 wrote to memory of 2468 1468 1A2A.tmp 95 PID 2468 wrote to memory of 3308 2468 1B24.tmp 96 PID 3308 wrote to memory of 3016 3308 1BD0.tmp 97 PID 3016 wrote to memory of 4680 3016 1CE9.tmp 98 PID 4680 wrote to memory of 3144 4680 1DD4.tmp 99 PID 3144 wrote to memory of 4036 3144 1EAE.tmp 100 PID 4036 wrote to memory of 772 4036 1FA8.tmp 101 PID 772 wrote to memory of 4808 772 20D1.tmp 102 PID 4808 wrote to memory of 2528 4808 21DB.tmp 103 PID 2528 wrote to memory of 1788 2528 22C5.tmp 104 PID 1788 wrote to memory of 3200 1788 23DF.tmp 105 PID 3200 wrote to memory of 4572 3200 24E8.tmp 106 PID 4572 wrote to memory of 1016 4572 2601.tmp 107 PID 1016 wrote to memory of 2408 1016 272A.tmp 108 PID 2408 wrote to memory of 456 2408 2834.tmp 109 PID 456 wrote to memory of 416 456 291E.tmp 110 PID 416 wrote to memory of 1232 416 29E9.tmp 111 PID 1232 wrote to memory of 4172 1232 2AE3.tmp 112 PID 4172 wrote to memory of 1680 4172 2BBE.tmp 113 PID 1680 wrote to memory of 1924 1680 2CB8.tmp 114 PID 1924 wrote to memory of 736 1924 2DB2.tmp 115 PID 736 wrote to memory of 4088 736 2E9D.tmp 116 PID 4088 wrote to memory of 4472 4088 2F87.tmp 117 PID 4472 wrote to memory of 2400 4472 3081.tmp 118 PID 2400 wrote to memory of 4164 2400 311D.tmp 119 PID 4164 wrote to memory of 1084 4164 31B9.tmp 120 PID 1084 wrote to memory of 2604 1084 3246.tmp 121 PID 2604 wrote to memory of 5028 2604 32C3.tmp 122 PID 5028 wrote to memory of 3964 5028 3350.tmp 123 PID 3964 wrote to memory of 880 3964 33FC.tmp 124 PID 880 wrote to memory of 4264 880 3498.tmp 125 PID 4264 wrote to memory of 2420 4264 3553.tmp 126 PID 2420 wrote to memory of 4368 2420 35F0.tmp 127 PID 4368 wrote to memory of 1852 4368 368C.tmp 128 PID 1852 wrote to memory of 2356 1852 3718.tmp 129 PID 2356 wrote to memory of 1288 2356 37B5.tmp 130 PID 1288 wrote to memory of 3004 1288 3851.tmp 131 PID 3004 wrote to memory of 4244 3004 38DE.tmp 132 PID 4244 wrote to memory of 4636 4244 396A.tmp 133 PID 4636 wrote to memory of 2828 4636 39F7.tmp 134 PID 2828 wrote to memory of 4056 2828 3A45.tmp 135 PID 4056 wrote to memory of 4000 4056 3AC2.tmp 136 PID 4000 wrote to memory of 3968 4000 3B10.tmp 137 PID 3968 wrote to memory of 2660 3968 3B7D.tmp 138 PID 2660 wrote to memory of 2428 2660 3BDB.tmp 139 PID 2428 wrote to memory of 4548 2428 3C29.tmp 140 PID 4548 wrote to memory of 3936 4548 3C87.tmp 141 PID 3936 wrote to memory of 4188 3936 3D04.tmp 142 PID 4188 wrote to memory of 1180 4188 3D81.tmp 143 PID 1180 wrote to memory of 4828 1180 3DDF.tmp 144 PID 4828 wrote to memory of 3148 4828 3E3D.tmp 145 PID 3148 wrote to memory of 3488 3148 3EAA.tmp 146 PID 3488 wrote to memory of 2480 3488 3F37.tmp 147 PID 2480 wrote to memory of 1160 2480 3FB4.tmp 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_e081117c337e611ee6948ad8b776adb2_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e081117c337e611ee6948ad8b776adb2_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\10C4.tmp"C:\Users\Admin\AppData\Local\Temp\10C4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\122B.tmp"C:\Users\Admin\AppData\Local\Temp\122B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\1335.tmp"C:\Users\Admin\AppData\Local\Temp\1335.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\145E.tmp"C:\Users\Admin\AppData\Local\Temp\145E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\1661.tmp"C:\Users\Admin\AppData\Local\Temp\1661.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\174C.tmp"C:\Users\Admin\AppData\Local\Temp\174C.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\1827.tmp"C:\Users\Admin\AppData\Local\Temp\1827.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\194F.tmp"C:\Users\Admin\AppData\Local\Temp\194F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"C:\Users\Admin\AppData\Local\Temp\1A2A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\1B24.tmp"C:\Users\Admin\AppData\Local\Temp\1B24.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\20D1.tmp"C:\Users\Admin\AppData\Local\Temp\20D1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\21DB.tmp"C:\Users\Admin\AppData\Local\Temp\21DB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\23DF.tmp"C:\Users\Admin\AppData\Local\Temp\23DF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\2601.tmp"C:\Users\Admin\AppData\Local\Temp\2601.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\272A.tmp"C:\Users\Admin\AppData\Local\Temp\272A.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\291E.tmp"C:\Users\Admin\AppData\Local\Temp\291E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\29E9.tmp"C:\Users\Admin\AppData\Local\Temp\29E9.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"C:\Users\Admin\AppData\Local\Temp\2CB8.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\2F87.tmp"C:\Users\Admin\AppData\Local\Temp\2F87.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\3081.tmp"C:\Users\Admin\AppData\Local\Temp\3081.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\311D.tmp"C:\Users\Admin\AppData\Local\Temp\311D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\3246.tmp"C:\Users\Admin\AppData\Local\Temp\3246.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\35F0.tmp"C:\Users\Admin\AppData\Local\Temp\35F0.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\368C.tmp"C:\Users\Admin\AppData\Local\Temp\368C.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\3718.tmp"C:\Users\Admin\AppData\Local\Temp\3718.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\3851.tmp"C:\Users\Admin\AppData\Local\Temp\3851.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\38DE.tmp"C:\Users\Admin\AppData\Local\Temp\38DE.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\39F7.tmp"C:\Users\Admin\AppData\Local\Temp\39F7.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\3A45.tmp"C:\Users\Admin\AppData\Local\Temp\3A45.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\3B10.tmp"C:\Users\Admin\AppData\Local\Temp\3B10.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"C:\Users\Admin\AppData\Local\Temp\3BDB.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\3C29.tmp"C:\Users\Admin\AppData\Local\Temp\3C29.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\3C87.tmp"C:\Users\Admin\AppData\Local\Temp\3C87.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\3D04.tmp"C:\Users\Admin\AppData\Local\Temp\3D04.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\3D81.tmp"C:\Users\Admin\AppData\Local\Temp\3D81.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\3F37.tmp"C:\Users\Admin\AppData\Local\Temp\3F37.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"C:\Users\Admin\AppData\Local\Temp\3FB4.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\4021.tmp"C:\Users\Admin\AppData\Local\Temp\4021.tmp"65⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\40AE.tmp"C:\Users\Admin\AppData\Local\Temp\40AE.tmp"66⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\40FC.tmp"C:\Users\Admin\AppData\Local\Temp\40FC.tmp"67⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\4169.tmp"C:\Users\Admin\AppData\Local\Temp\4169.tmp"68⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\4205.tmp"C:\Users\Admin\AppData\Local\Temp\4205.tmp"69⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\4253.tmp"C:\Users\Admin\AppData\Local\Temp\4253.tmp"70⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\42D0.tmp"C:\Users\Admin\AppData\Local\Temp\42D0.tmp"71⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\433E.tmp"C:\Users\Admin\AppData\Local\Temp\433E.tmp"72⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\43AB.tmp"C:\Users\Admin\AppData\Local\Temp\43AB.tmp"73⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"74⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"75⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\44C4.tmp"C:\Users\Admin\AppData\Local\Temp\44C4.tmp"76⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\4541.tmp"C:\Users\Admin\AppData\Local\Temp\4541.tmp"77⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\45DE.tmp"C:\Users\Admin\AppData\Local\Temp\45DE.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\465B.tmp"C:\Users\Admin\AppData\Local\Temp\465B.tmp"79⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\46C8.tmp"C:\Users\Admin\AppData\Local\Temp\46C8.tmp"80⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\4726.tmp"C:\Users\Admin\AppData\Local\Temp\4726.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"82⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\4810.tmp"C:\Users\Admin\AppData\Local\Temp\4810.tmp"83⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\486E.tmp"C:\Users\Admin\AppData\Local\Temp\486E.tmp"84⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\48CC.tmp"C:\Users\Admin\AppData\Local\Temp\48CC.tmp"85⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\4929.tmp"C:\Users\Admin\AppData\Local\Temp\4929.tmp"86⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\4987.tmp"C:\Users\Admin\AppData\Local\Temp\4987.tmp"87⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\49E5.tmp"C:\Users\Admin\AppData\Local\Temp\49E5.tmp"88⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\4A43.tmp"C:\Users\Admin\AppData\Local\Temp\4A43.tmp"89⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"90⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"91⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"92⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"C:\Users\Admin\AppData\Local\Temp\4B8B.tmp"93⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\4BF8.tmp"C:\Users\Admin\AppData\Local\Temp\4BF8.tmp"94⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\4C56.tmp"C:\Users\Admin\AppData\Local\Temp\4C56.tmp"95⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"96⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\4D11.tmp"C:\Users\Admin\AppData\Local\Temp\4D11.tmp"97⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"99⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"100⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\4E79.tmp"C:\Users\Admin\AppData\Local\Temp\4E79.tmp"101⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\4EC7.tmp"C:\Users\Admin\AppData\Local\Temp\4EC7.tmp"102⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\4F25.tmp"C:\Users\Admin\AppData\Local\Temp\4F25.tmp"103⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"104⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"C:\Users\Admin\AppData\Local\Temp\4FFF.tmp"105⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\505D.tmp"C:\Users\Admin\AppData\Local\Temp\505D.tmp"106⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\50AB.tmp"C:\Users\Admin\AppData\Local\Temp\50AB.tmp"107⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\5119.tmp"C:\Users\Admin\AppData\Local\Temp\5119.tmp"108⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\5167.tmp"C:\Users\Admin\AppData\Local\Temp\5167.tmp"109⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\51B5.tmp"C:\Users\Admin\AppData\Local\Temp\51B5.tmp"110⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\5213.tmp"C:\Users\Admin\AppData\Local\Temp\5213.tmp"111⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\5270.tmp"C:\Users\Admin\AppData\Local\Temp\5270.tmp"112⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\52CE.tmp"C:\Users\Admin\AppData\Local\Temp\52CE.tmp"113⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\533C.tmp"C:\Users\Admin\AppData\Local\Temp\533C.tmp"114⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"115⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\53F7.tmp"C:\Users\Admin\AppData\Local\Temp\53F7.tmp"116⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\5445.tmp"C:\Users\Admin\AppData\Local\Temp\5445.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\54B3.tmp"C:\Users\Admin\AppData\Local\Temp\54B3.tmp"118⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\5510.tmp"C:\Users\Admin\AppData\Local\Temp\5510.tmp"119⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\555E.tmp"C:\Users\Admin\AppData\Local\Temp\555E.tmp"120⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\55AD.tmp"C:\Users\Admin\AppData\Local\Temp\55AD.tmp"121⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\55FB.tmp"C:\Users\Admin\AppData\Local\Temp\55FB.tmp"122⤵PID:1292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-