Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/08/2026, 04:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_703a41857c54abfaff3214eaeb853265_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_703a41857c54abfaff3214eaeb853265_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-16_703a41857c54abfaff3214eaeb853265_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260816-eynvsscr5t
- SHA256 ceb2169a9661d63bf731ada993d2b6a1349c83390d289ac70f8360820e2897e1
- MD5 703a41857c54abfaff3214eaeb853265
- SHA1 b7249873098da671f1e9985072fbc88e402cf9a5
- SHA512 6fe23a940c19e1f4f7c8c918ddea0d821e6d086e4cf2a93d20ae520070770fba4918691299a4081d752db49698e2adced7335be15eaa4f27f16bd442aeee2c8e
- SSDEEP 12288:9U5rCOTei6N7oIe4YwF2IS4GmyY7X2dIzzXsVgqZoXWjdq:9UQOJ6/YwF2UBzQgqqGh
- TLSH T144C4F1217581C032E6E202314EE2EBB1697F7C354B26A4C76B84667E6FB92E1D774307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4228 1393.tmp 4004 142F.tmp 924 14CB.tmp 4020 15C5.tmp 3712 1652.tmp 3084 171D.tmp 4000 17C9.tmp 1816 1875.tmp 2996 1911.tmp 2312 19AD.tmp 1248 1A59.tmp 3440 1AF5.tmp 3332 1BA1.tmp 3388 1C3D.tmp 3524 1CCA.tmp 2556 1D66.tmp 2940 1E12.tmp 4048 1E9F.tmp 1392 1F5A.tmp 3100 2016.tmp 3428 2083.tmp 3016 211F.tmp 3108 21AC.tmp 1332 2248.tmp 604 22E5.tmp 1096 2352.tmp 4356 240D.tmp 2908 24AA.tmp 1812 2546.tmp 4412 25D3.tmp 2892 266F.tmp 1396 271B.tmp 1704 27A7.tmp 204 27F5.tmp 1488 2863.tmp 844 28B1.tmp 2192 291E.tmp 2984 298C.tmp 2324 29DA.tmp 3280 2A47.tmp 2864 2AA5.tmp 4156 2B12.tmp 4084 2B60.tmp 1432 2BAF.tmp 1644 2BFD.tmp 3804 2C4B.tmp 1820 2C99.tmp 4140 2CE7.tmp 3840 2D45.tmp 3136 2DA3.tmp 4264 2DF1.tmp 1272 2E4E.tmp 4320 2EBC.tmp 4768 2F0A.tmp 1956 2F58.tmp 1020 2FA6.tmp 4632 3004.tmp 4704 3052.tmp 5060 30BF.tmp 2172 310E.tmp 2400 315C.tmp 2320 31AA.tmp 2260 3208.tmp 4936 3246.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6414.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 484A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7258.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6230.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 333B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 811D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 454C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8497.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 209E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7778.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 948A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C493.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 819F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 388B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5078.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 740D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3908 wrote to memory of 4228 3908 2026-08-16_703a41857c54abfaff3214eaeb853265_elex_mafia_stealc_tofsee.exe 83 PID 4228 wrote to memory of 4004 4228 1393.tmp 84 PID 4004 wrote to memory of 924 4004 142F.tmp 85 PID 924 wrote to memory of 4020 924 14CB.tmp 86 PID 4020 wrote to memory of 3712 4020 15C5.tmp 87 PID 3712 wrote to memory of 3084 3712 1652.tmp 88 PID 3084 wrote to memory of 4000 3084 171D.tmp 89 PID 4000 wrote to memory of 1816 4000 17C9.tmp 90 PID 1816 wrote to memory of 2996 1816 1875.tmp 91 PID 2996 wrote to memory of 2312 2996 1911.tmp 92 PID 2312 wrote to memory of 1248 2312 19AD.tmp 93 PID 1248 wrote to memory of 3440 1248 1A59.tmp 94 PID 3440 wrote to memory of 3332 3440 1AF5.tmp 95 PID 3332 wrote to memory of 3388 3332 1BA1.tmp 96 PID 3388 wrote to memory of 3524 3388 1C3D.tmp 97 PID 3524 wrote to memory of 2556 3524 1CCA.tmp 98 PID 2556 wrote to memory of 2940 2556 1D66.tmp 99 PID 2940 wrote to memory of 4048 2940 1E12.tmp 100 PID 4048 wrote to memory of 1392 4048 1E9F.tmp 101 PID 1392 wrote to memory of 3100 1392 1F5A.tmp 102 PID 3100 wrote to memory of 3428 3100 2016.tmp 103 PID 3428 wrote to memory of 3016 3428 2083.tmp 104 PID 3016 wrote to memory of 3108 3016 211F.tmp 105 PID 3108 wrote to memory of 1332 3108 21AC.tmp 106 PID 1332 wrote to memory of 604 1332 2248.tmp 107 PID 604 wrote to memory of 1096 604 22E5.tmp 108 PID 1096 wrote to memory of 4356 1096 2352.tmp 109 PID 4356 wrote to memory of 2908 4356 240D.tmp 110 PID 2908 wrote to memory of 1812 2908 24AA.tmp 111 PID 1812 wrote to memory of 4412 1812 2546.tmp 112 PID 4412 wrote to memory of 2892 4412 25D3.tmp 113 PID 2892 wrote to memory of 1396 2892 266F.tmp 114 PID 1396 wrote to memory of 1704 1396 271B.tmp 115 PID 1704 wrote to memory of 204 1704 27A7.tmp 116 PID 204 wrote to memory of 1488 204 27F5.tmp 117 PID 1488 wrote to memory of 844 1488 2863.tmp 118 PID 844 wrote to memory of 2192 844 28B1.tmp 119 PID 2192 wrote to memory of 2984 2192 291E.tmp 120 PID 2984 wrote to memory of 2324 2984 298C.tmp 121 PID 2324 wrote to memory of 3280 2324 29DA.tmp 122 PID 3280 wrote to memory of 2864 3280 2A47.tmp 123 PID 2864 wrote to memory of 4156 2864 2AA5.tmp 124 PID 4156 wrote to memory of 4084 4156 2B12.tmp 125 PID 4084 wrote to memory of 1432 4084 2B60.tmp 126 PID 1432 wrote to memory of 1644 1432 2BAF.tmp 127 PID 1644 wrote to memory of 3804 1644 2BFD.tmp 128 PID 3804 wrote to memory of 1820 3804 2C4B.tmp 129 PID 1820 wrote to memory of 4140 1820 2C99.tmp 130 PID 4140 wrote to memory of 3840 4140 2CE7.tmp 132 PID 3840 wrote to memory of 3136 3840 2D45.tmp 133 PID 3136 wrote to memory of 4264 3136 2DA3.tmp 134 PID 4264 wrote to memory of 1272 4264 2DF1.tmp 135 PID 1272 wrote to memory of 4320 1272 2E4E.tmp 136 PID 4320 wrote to memory of 4768 4320 2EBC.tmp 138 PID 4768 wrote to memory of 1956 4768 2F0A.tmp 140 PID 1956 wrote to memory of 1020 1956 2F58.tmp 141 PID 1020 wrote to memory of 4632 1020 2FA6.tmp 143 PID 4632 wrote to memory of 4704 4632 3004.tmp 144 PID 4704 wrote to memory of 5060 4704 3052.tmp 145 PID 5060 wrote to memory of 2172 5060 30BF.tmp 146 PID 2172 wrote to memory of 2400 2172 310E.tmp 148 PID 2400 wrote to memory of 2320 2400 315C.tmp 149 PID 2320 wrote to memory of 2260 2320 31AA.tmp 150 PID 2260 wrote to memory of 4936 2260 3208.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_703a41857c54abfaff3214eaeb853265_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_703a41857c54abfaff3214eaeb853265_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\1393.tmp"C:\Users\Admin\AppData\Local\Temp\1393.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\142F.tmp"C:\Users\Admin\AppData\Local\Temp\142F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\14CB.tmp"C:\Users\Admin\AppData\Local\Temp\14CB.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\15C5.tmp"C:\Users\Admin\AppData\Local\Temp\15C5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\171D.tmp"C:\Users\Admin\AppData\Local\Temp\171D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\1911.tmp"C:\Users\Admin\AppData\Local\Temp\1911.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\19AD.tmp"C:\Users\Admin\AppData\Local\Temp\19AD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"C:\Users\Admin\AppData\Local\Temp\1C3D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\1E12.tmp"C:\Users\Admin\AppData\Local\Temp\1E12.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\2016.tmp"C:\Users\Admin\AppData\Local\Temp\2016.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\2083.tmp"C:\Users\Admin\AppData\Local\Temp\2083.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\211F.tmp"C:\Users\Admin\AppData\Local\Temp\211F.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\21AC.tmp"C:\Users\Admin\AppData\Local\Temp\21AC.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\2248.tmp"C:\Users\Admin\AppData\Local\Temp\2248.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
C:\Users\Admin\AppData\Local\Temp\2352.tmp"C:\Users\Admin\AppData\Local\Temp\2352.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\240D.tmp"C:\Users\Admin\AppData\Local\Temp\240D.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\24AA.tmp"C:\Users\Admin\AppData\Local\Temp\24AA.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\266F.tmp"C:\Users\Admin\AppData\Local\Temp\266F.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\271B.tmp"C:\Users\Admin\AppData\Local\Temp\271B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\27A7.tmp"C:\Users\Admin\AppData\Local\Temp\27A7.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\2863.tmp"C:\Users\Admin\AppData\Local\Temp\2863.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\28B1.tmp"C:\Users\Admin\AppData\Local\Temp\28B1.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\291E.tmp"C:\Users\Admin\AppData\Local\Temp\291E.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\298C.tmp"C:\Users\Admin\AppData\Local\Temp\298C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\29DA.tmp"C:\Users\Admin\AppData\Local\Temp\29DA.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\2A47.tmp"C:\Users\Admin\AppData\Local\Temp\2A47.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\2B12.tmp"C:\Users\Admin\AppData\Local\Temp\2B12.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\2B60.tmp"C:\Users\Admin\AppData\Local\Temp\2B60.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"C:\Users\Admin\AppData\Local\Temp\2BAF.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"C:\Users\Admin\AppData\Local\Temp\2BFD.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\2C99.tmp"C:\Users\Admin\AppData\Local\Temp\2C99.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\2D45.tmp"C:\Users\Admin\AppData\Local\Temp\2D45.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"C:\Users\Admin\AppData\Local\Temp\2DF1.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"C:\Users\Admin\AppData\Local\Temp\2F0A.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\2F58.tmp"C:\Users\Admin\AppData\Local\Temp\2F58.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\3004.tmp"C:\Users\Admin\AppData\Local\Temp\3004.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\30BF.tmp"C:\Users\Admin\AppData\Local\Temp\30BF.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\310E.tmp"C:\Users\Admin\AppData\Local\Temp\310E.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\315C.tmp"C:\Users\Admin\AppData\Local\Temp\315C.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\3246.tmp"C:\Users\Admin\AppData\Local\Temp\3246.tmp"65⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\3294.tmp"C:\Users\Admin\AppData\Local\Temp\3294.tmp"66⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\32E2.tmp"C:\Users\Admin\AppData\Local\Temp\32E2.tmp"67⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"68⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"69⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\33FC.tmp"C:\Users\Admin\AppData\Local\Temp\33FC.tmp"70⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"71⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"72⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\34F6.tmp"C:\Users\Admin\AppData\Local\Temp\34F6.tmp"73⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"74⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"75⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\35FF.tmp"C:\Users\Admin\AppData\Local\Temp\35FF.tmp"76⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"77⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\36CA.tmp"C:\Users\Admin\AppData\Local\Temp\36CA.tmp"78⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\3718.tmp"C:\Users\Admin\AppData\Local\Temp\3718.tmp"79⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\3767.tmp"C:\Users\Admin\AppData\Local\Temp\3767.tmp"80⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\37C4.tmp"C:\Users\Admin\AppData\Local\Temp\37C4.tmp"81⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\3832.tmp"C:\Users\Admin\AppData\Local\Temp\3832.tmp"82⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\389F.tmp"C:\Users\Admin\AppData\Local\Temp\389F.tmp"83⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\38ED.tmp"C:\Users\Admin\AppData\Local\Temp\38ED.tmp"84⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\395B.tmp"C:\Users\Admin\AppData\Local\Temp\395B.tmp"85⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\39A9.tmp"C:\Users\Admin\AppData\Local\Temp\39A9.tmp"86⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\39F7.tmp"C:\Users\Admin\AppData\Local\Temp\39F7.tmp"87⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\3A55.tmp"C:\Users\Admin\AppData\Local\Temp\3A55.tmp"88⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"89⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\3B00.tmp"C:\Users\Admin\AppData\Local\Temp\3B00.tmp"90⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"91⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"C:\Users\Admin\AppData\Local\Temp\3BEB.tmp"92⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\3C39.tmp"C:\Users\Admin\AppData\Local\Temp\3C39.tmp"93⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\3C97.tmp"C:\Users\Admin\AppData\Local\Temp\3C97.tmp"94⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"C:\Users\Admin\AppData\Local\Temp\3CE5.tmp"95⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\3D33.tmp"C:\Users\Admin\AppData\Local\Temp\3D33.tmp"96⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\3D81.tmp"C:\Users\Admin\AppData\Local\Temp\3D81.tmp"97⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"C:\Users\Admin\AppData\Local\Temp\3DDF.tmp"98⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"99⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"C:\Users\Admin\AppData\Local\Temp\3E7B.tmp"100⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"101⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\3F17.tmp"C:\Users\Admin\AppData\Local\Temp\3F17.tmp"102⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\3F65.tmp"C:\Users\Admin\AppData\Local\Temp\3F65.tmp"103⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"104⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\4011.tmp"C:\Users\Admin\AppData\Local\Temp\4011.tmp"105⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\405F.tmp"C:\Users\Admin\AppData\Local\Temp\405F.tmp"106⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\40AE.tmp"C:\Users\Admin\AppData\Local\Temp\40AE.tmp"107⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\411B.tmp"C:\Users\Admin\AppData\Local\Temp\411B.tmp"108⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\4188.tmp"C:\Users\Admin\AppData\Local\Temp\4188.tmp"109⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\41D6.tmp"C:\Users\Admin\AppData\Local\Temp\41D6.tmp"110⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\4225.tmp"C:\Users\Admin\AppData\Local\Temp\4225.tmp"111⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\4273.tmp"C:\Users\Admin\AppData\Local\Temp\4273.tmp"112⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\42D0.tmp"C:\Users\Admin\AppData\Local\Temp\42D0.tmp"113⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\433E.tmp"C:\Users\Admin\AppData\Local\Temp\433E.tmp"114⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\439C.tmp"C:\Users\Admin\AppData\Local\Temp\439C.tmp"115⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\43F9.tmp"C:\Users\Admin\AppData\Local\Temp\43F9.tmp"116⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\4447.tmp"C:\Users\Admin\AppData\Local\Temp\4447.tmp"117⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\44A5.tmp"C:\Users\Admin\AppData\Local\Temp\44A5.tmp"118⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\44F3.tmp"C:\Users\Admin\AppData\Local\Temp\44F3.tmp"119⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\4541.tmp"C:\Users\Admin\AppData\Local\Temp\4541.tmp"120⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\459F.tmp"C:\Users\Admin\AppData\Local\Temp\459F.tmp"121⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\45FD.tmp"C:\Users\Admin\AppData\Local\Temp\45FD.tmp"122⤵PID:3272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-