Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 17:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_25048f001036a6159eb696cba0e6f029_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_25048f001036a6159eb696cba0e6f029_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-10_25048f001036a6159eb696cba0e6f029_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260810-v5bf2she78
- SHA256 93abe7a000445b6a0b2ceeaacee04b9b5c0f83a0abf71af880b66dbeca3e8064
- MD5 25048f001036a6159eb696cba0e6f029
- SHA1 364008ef58842c565f705fb83e9a05e10feb0d3c
- SHA512 9c9f1ad0f8716713a791079bf99b636563185e8ed0d4d9c37182b65498edc6e2f293d567688034d6769cee2a90108ca248849f4937bfa60c2a3a6f81babe7f46
- SSDEEP 12288:wU5rCOTeiDZnQHP7vN/dbg3DYYRCGcNZ+3/v+I9hUG2VA:wUQOJDhQv7F/JOUccNGEA
- TLSH T1DCE4D12173D88536E5FB037859B5E6654D7EBD326722D6CF2F8016AE0AB1BC08631723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1696 D0B.tmp 1400 E43.tmp 3992 F3D.tmp 4080 10A5.tmp 4820 1160.tmp 1216 12D7.tmp 2296 1400.tmp 724 14EA.tmp 2088 15E4.tmp 4248 170D.tmp 1636 17F8.tmp 4768 18F2.tmp 2864 1A1B.tmp 2028 1B05.tmp 3720 1C0F.tmp 2876 1CCA.tmp 2568 1DE3.tmp 3336 1EDD.tmp 2196 1FD7.tmp 2360 2100.tmp 3276 2248.tmp 2852 2313.tmp 4932 243C.tmp 3020 2536.tmp 444 2611.tmp 3840 271B.tmp 5048 27F5.tmp 4756 28FF.tmp 2116 29E9.tmp 2424 2AD4.tmp 1048 2BED.tmp 1620 2D35.tmp 4664 2E5E.tmp 1348 2F29.tmp 1600 2FA6.tmp 1960 3052.tmp 5112 30EE.tmp 4924 316B.tmp 3272 3217.tmp 4592 32F2.tmp 3048 33BD.tmp 3376 3488.tmp 744 3534.tmp 1576 35D0.tmp 4220 366D.tmp 2592 3738.tmp 4988 37B5.tmp 4772 3841.tmp 3744 390C.tmp 540 3989.tmp 2308 39F7.tmp 3500 3A45.tmp 4712 3AA3.tmp 2176 3AF1.tmp 860 3B5E.tmp 4388 3BBC.tmp 1884 3C29.tmp 1560 3C87.tmp 3520 3D33.tmp 4760 3DA0.tmp 3756 3DFE.tmp 2848 3E5C.tmp 3420 3EC9.tmp 1540 3F37.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2215.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8836.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 871D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F41F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6354.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 366D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5615.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4532.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8989.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5678.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3908.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5068.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E104.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 647D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4908 wrote to memory of 1696 4908 2026-08-10_25048f001036a6159eb696cba0e6f029_elex_mafia_stealc_tofsee.exe 85 PID 1696 wrote to memory of 1400 1696 D0B.tmp 86 PID 1400 wrote to memory of 3992 1400 E43.tmp 87 PID 3992 wrote to memory of 4080 3992 F3D.tmp 88 PID 4080 wrote to memory of 4820 4080 10A5.tmp 89 PID 4820 wrote to memory of 1216 4820 1160.tmp 90 PID 1216 wrote to memory of 2296 1216 12D7.tmp 91 PID 2296 wrote to memory of 724 2296 1400.tmp 92 PID 724 wrote to memory of 2088 724 14EA.tmp 93 PID 2088 wrote to memory of 4248 2088 15E4.tmp 94 PID 4248 wrote to memory of 1636 4248 170D.tmp 95 PID 1636 wrote to memory of 4768 1636 17F8.tmp 96 PID 4768 wrote to memory of 2864 4768 18F2.tmp 97 PID 2864 wrote to memory of 2028 2864 1A1B.tmp 98 PID 2028 wrote to memory of 3720 2028 1B05.tmp 99 PID 3720 wrote to memory of 2876 3720 1C0F.tmp 100 PID 2876 wrote to memory of 2568 2876 1CCA.tmp 103 PID 2568 wrote to memory of 3336 2568 1DE3.tmp 104 PID 3336 wrote to memory of 2196 3336 1EDD.tmp 105 PID 2196 wrote to memory of 2360 2196 1FD7.tmp 106 PID 2360 wrote to memory of 3276 2360 2100.tmp 108 PID 3276 wrote to memory of 2852 3276 2248.tmp 109 PID 2852 wrote to memory of 4932 2852 2313.tmp 111 PID 4932 wrote to memory of 3020 4932 243C.tmp 112 PID 3020 wrote to memory of 444 3020 2536.tmp 113 PID 444 wrote to memory of 3840 444 2611.tmp 114 PID 3840 wrote to memory of 5048 3840 271B.tmp 115 PID 5048 wrote to memory of 4756 5048 27F5.tmp 116 PID 4756 wrote to memory of 2116 4756 28FF.tmp 117 PID 2116 wrote to memory of 2424 2116 29E9.tmp 118 PID 2424 wrote to memory of 1048 2424 2AD4.tmp 119 PID 1048 wrote to memory of 1620 1048 2BED.tmp 120 PID 1620 wrote to memory of 4664 1620 2D35.tmp 122 PID 4664 wrote to memory of 1348 4664 2E5E.tmp 123 PID 1348 wrote to memory of 1600 1348 2F29.tmp 124 PID 1600 wrote to memory of 1960 1600 2FA6.tmp 125 PID 1960 wrote to memory of 5112 1960 3052.tmp 126 PID 5112 wrote to memory of 4924 5112 30EE.tmp 127 PID 4924 wrote to memory of 3272 4924 316B.tmp 128 PID 3272 wrote to memory of 4592 3272 3217.tmp 129 PID 4592 wrote to memory of 3048 4592 32F2.tmp 130 PID 3048 wrote to memory of 3376 3048 33BD.tmp 131 PID 3376 wrote to memory of 744 3376 3488.tmp 132 PID 744 wrote to memory of 1576 744 3534.tmp 133 PID 1576 wrote to memory of 4220 1576 35D0.tmp 134 PID 4220 wrote to memory of 2592 4220 366D.tmp 135 PID 2592 wrote to memory of 4988 2592 3738.tmp 136 PID 4988 wrote to memory of 4772 4988 37B5.tmp 137 PID 4772 wrote to memory of 3744 4772 3841.tmp 138 PID 3744 wrote to memory of 540 3744 390C.tmp 139 PID 540 wrote to memory of 2308 540 3989.tmp 141 PID 2308 wrote to memory of 3500 2308 39F7.tmp 143 PID 3500 wrote to memory of 4712 3500 3A45.tmp 144 PID 4712 wrote to memory of 2176 4712 3AA3.tmp 145 PID 2176 wrote to memory of 860 2176 3AF1.tmp 146 PID 860 wrote to memory of 4388 860 3B5E.tmp 147 PID 4388 wrote to memory of 1884 4388 3BBC.tmp 148 PID 1884 wrote to memory of 1560 1884 3C29.tmp 149 PID 1560 wrote to memory of 3520 1560 3C87.tmp 150 PID 3520 wrote to memory of 4760 3520 3D33.tmp 151 PID 4760 wrote to memory of 3756 4760 3DA0.tmp 152 PID 3756 wrote to memory of 2848 3756 3DFE.tmp 153 PID 2848 wrote to memory of 3420 2848 3E5C.tmp 154 PID 3420 wrote to memory of 1540 3420 3EC9.tmp 155
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_25048f001036a6159eb696cba0e6f029_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_25048f001036a6159eb696cba0e6f029_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\10A5.tmp"C:\Users\Admin\AppData\Local\Temp\10A5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\1160.tmp"C:\Users\Admin\AppData\Local\Temp\1160.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\14EA.tmp"C:\Users\Admin\AppData\Local\Temp\14EA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\15E4.tmp"C:\Users\Admin\AppData\Local\Temp\15E4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\170D.tmp"C:\Users\Admin\AppData\Local\Temp\170D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\17F8.tmp"C:\Users\Admin\AppData\Local\Temp\17F8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\1B05.tmp"C:\Users\Admin\AppData\Local\Temp\1B05.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\2100.tmp"C:\Users\Admin\AppData\Local\Temp\2100.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\2248.tmp"C:\Users\Admin\AppData\Local\Temp\2248.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\2313.tmp"C:\Users\Admin\AppData\Local\Temp\2313.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\243C.tmp"C:\Users\Admin\AppData\Local\Temp\243C.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\2536.tmp"C:\Users\Admin\AppData\Local\Temp\2536.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\2611.tmp"C:\Users\Admin\AppData\Local\Temp\2611.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Users\Admin\AppData\Local\Temp\271B.tmp"C:\Users\Admin\AppData\Local\Temp\271B.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\29E9.tmp"C:\Users\Admin\AppData\Local\Temp\29E9.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"C:\Users\Admin\AppData\Local\Temp\2AD4.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\2BED.tmp"C:\Users\Admin\AppData\Local\Temp\2BED.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\2D35.tmp"C:\Users\Admin\AppData\Local\Temp\2D35.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"C:\Users\Admin\AppData\Local\Temp\2E5E.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\316B.tmp"C:\Users\Admin\AppData\Local\Temp\316B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\3217.tmp"C:\Users\Admin\AppData\Local\Temp\3217.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\32F2.tmp"C:\Users\Admin\AppData\Local\Temp\32F2.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\3738.tmp"C:\Users\Admin\AppData\Local\Temp\3738.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\390C.tmp"C:\Users\Admin\AppData\Local\Temp\390C.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\3989.tmp"C:\Users\Admin\AppData\Local\Temp\3989.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\39F7.tmp"C:\Users\Admin\AppData\Local\Temp\39F7.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\3A45.tmp"C:\Users\Admin\AppData\Local\Temp\3A45.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"C:\Users\Admin\AppData\Local\Temp\3AF1.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"C:\Users\Admin\AppData\Local\Temp\3B5E.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\3C29.tmp"C:\Users\Admin\AppData\Local\Temp\3C29.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\3C87.tmp"C:\Users\Admin\AppData\Local\Temp\3C87.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\3D33.tmp"C:\Users\Admin\AppData\Local\Temp\3D33.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"C:\Users\Admin\AppData\Local\Temp\3DA0.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"C:\Users\Admin\AppData\Local\Temp\3DFE.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"C:\Users\Admin\AppData\Local\Temp\3E5C.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\3F37.tmp"C:\Users\Admin\AppData\Local\Temp\3F37.tmp"65⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"C:\Users\Admin\AppData\Local\Temp\3FA4.tmp"66⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\4021.tmp"C:\Users\Admin\AppData\Local\Temp\4021.tmp"67⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\406F.tmp"C:\Users\Admin\AppData\Local\Temp\406F.tmp"68⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\40BD.tmp"C:\Users\Admin\AppData\Local\Temp\40BD.tmp"69⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\410B.tmp"C:\Users\Admin\AppData\Local\Temp\410B.tmp"70⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\41A8.tmp"C:\Users\Admin\AppData\Local\Temp\41A8.tmp"71⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\4225.tmp"C:\Users\Admin\AppData\Local\Temp\4225.tmp"72⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\4292.tmp"C:\Users\Admin\AppData\Local\Temp\4292.tmp"73⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\42F0.tmp"C:\Users\Admin\AppData\Local\Temp\42F0.tmp"74⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\434D.tmp"C:\Users\Admin\AppData\Local\Temp\434D.tmp"75⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\43AB.tmp"C:\Users\Admin\AppData\Local\Temp\43AB.tmp"76⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"77⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"78⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\44D4.tmp"C:\Users\Admin\AppData\Local\Temp\44D4.tmp"79⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\4532.tmp"C:\Users\Admin\AppData\Local\Temp\4532.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\4590.tmp"C:\Users\Admin\AppData\Local\Temp\4590.tmp"81⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\45FD.tmp"C:\Users\Admin\AppData\Local\Temp\45FD.tmp"82⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\465B.tmp"C:\Users\Admin\AppData\Local\Temp\465B.tmp"83⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\46B8.tmp"C:\Users\Admin\AppData\Local\Temp\46B8.tmp"84⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\4726.tmp"C:\Users\Admin\AppData\Local\Temp\4726.tmp"85⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"86⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\47E1.tmp"C:\Users\Admin\AppData\Local\Temp\47E1.tmp"87⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\485E.tmp"C:\Users\Admin\AppData\Local\Temp\485E.tmp"88⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\48CC.tmp"C:\Users\Admin\AppData\Local\Temp\48CC.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\4929.tmp"C:\Users\Admin\AppData\Local\Temp\4929.tmp"90⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\4978.tmp"C:\Users\Admin\AppData\Local\Temp\4978.tmp"91⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\49D5.tmp"C:\Users\Admin\AppData\Local\Temp\49D5.tmp"92⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\4A33.tmp"C:\Users\Admin\AppData\Local\Temp\4A33.tmp"93⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"94⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"95⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"96⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\4BF8.tmp"C:\Users\Admin\AppData\Local\Temp\4BF8.tmp"97⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\4C56.tmp"C:\Users\Admin\AppData\Local\Temp\4C56.tmp"98⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"99⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\4D02.tmp"C:\Users\Admin\AppData\Local\Temp\4D02.tmp"100⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"C:\Users\Admin\AppData\Local\Temp\4D6F.tmp"101⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\4DCD.tmp"C:\Users\Admin\AppData\Local\Temp\4DCD.tmp"102⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"C:\Users\Admin\AppData\Local\Temp\4E2B.tmp"103⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\4E88.tmp"C:\Users\Admin\AppData\Local\Temp\4E88.tmp"104⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"105⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\4F54.tmp"C:\Users\Admin\AppData\Local\Temp\4F54.tmp"106⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"107⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\500F.tmp"C:\Users\Admin\AppData\Local\Temp\500F.tmp"108⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\506D.tmp"C:\Users\Admin\AppData\Local\Temp\506D.tmp"109⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\50CB.tmp"C:\Users\Admin\AppData\Local\Temp\50CB.tmp"110⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\5157.tmp"C:\Users\Admin\AppData\Local\Temp\5157.tmp"111⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\51C5.tmp"C:\Users\Admin\AppData\Local\Temp\51C5.tmp"112⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\5251.tmp"C:\Users\Admin\AppData\Local\Temp\5251.tmp"113⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\52BF.tmp"C:\Users\Admin\AppData\Local\Temp\52BF.tmp"114⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\531C.tmp"C:\Users\Admin\AppData\Local\Temp\531C.tmp"115⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\537A.tmp"C:\Users\Admin\AppData\Local\Temp\537A.tmp"116⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\53D8.tmp"C:\Users\Admin\AppData\Local\Temp\53D8.tmp"117⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\5436.tmp"C:\Users\Admin\AppData\Local\Temp\5436.tmp"118⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\54A3.tmp"C:\Users\Admin\AppData\Local\Temp\54A3.tmp"119⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\5501.tmp"C:\Users\Admin\AppData\Local\Temp\5501.tmp"120⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\554F.tmp"C:\Users\Admin\AppData\Local\Temp\554F.tmp"121⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\55AD.tmp"C:\Users\Admin\AppData\Local\Temp\55AD.tmp"122⤵PID:3228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-