Analysis
- max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/08/2026, 04:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-27_dc5fbca145b9a6d1949db54d2fa0577c_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
General
- Target 2026-08-27_dc5fbca145b9a6d1949db54d2fa0577c_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260828-e8fxyatbld
- SHA256 a72f9f00a1cf826f287a24463d88307b51085d9d47b42825d6ffa5eac483ddf8
- MD5 dc5fbca145b9a6d1949db54d2fa0577c
- SHA1 3822e767c1cd535dce8c8a3eed61053505eb4434
- SHA512 da8101dae2820b1dcefd551e292b2d57772c16259a8967536c8867434cd9f5167644fef375a93185c502bcf5af03c913f22ee49cadef7638dfb2d0b417ca1217
- SSDEEP 12288:wU5rCOTeiDF5lcoyeEMWrQ1CNRJUNZ+3/v+I9hUG2VA:wUQOJDF56eEMB1aPUNGEA
- TLSH T166E4D12173D88532E9FB037859B5E6615D7EBD36A722D6CF2F8016AE0971BC08631723
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Stealc stealer Version 3 1 IoCs
resource yara_rule behavioral1/memory/2304-6-0x0000000000830000-0x00000000008B3000-memory.dmp family_stealc_v3 - Executes dropped EXE 64 IoCs
pid Process 3124 3EE8.tmp 4140 3FC3.tmp 2696 40EC.tmp 1700 4234.tmp 4752 42FF.tmp 1716 43F9.tmp 3232 44B5.tmp 2576 4590.tmp 2644 463B.tmp 3996 4716.tmp 5116 4820.tmp 1080 490A.tmp 1564 4A04.tmp 4700 4B0E.tmp 4852 4BF8.tmp 4508 4CE3.tmp 3332 4DBD.tmp 1180 4EB7.tmp 3184 4F82.tmp 4172 507C.tmp 2368 5157.tmp 2032 5203.tmp 3008 530D.tmp 60 53F7.tmp 4468 54D2.tmp 1736 55AD.tmp 752 5687.tmp 2596 5762.tmp 2460 585C.tmp 4044 5975.tmp 744 5A6F.tmp 4352 5B4A.tmp 3092 5C25.tmp 2708 5CA2.tmp 836 5D1F.tmp 4800 5D9C.tmp 4728 5E48.tmp 612 5EA5.tmp 3212 5F51.tmp 1252 5FCE.tmp 1800 605B.tmp 2800 60E8.tmp 2292 6174.tmp 4968 6201.tmp 4220 629D.tmp 1768 631A.tmp 1364 63A7.tmp 3168 6443.tmp 3484 64B0.tmp 2920 64FE.tmp 4384 654D.tmp 1852 659B.tmp 4456 65E9.tmp 2856 6647.tmp 1824 66A4.tmp 3872 6702.tmp 1912 6750.tmp 3796 679E.tmp 4120 67EC.tmp 4708 683B.tmp 3816 6889.tmp 2736 68D7.tmp 916 6925.tmp 3384 6973.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8160.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D136.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8841.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6647.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C83D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3474.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 166C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 965F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F930.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1851.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2968.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1294.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42FF.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2304 wrote to memory of 3124 2304 2026-08-27_dc5fbca145b9a6d1949db54d2fa0577c_elex_mafia_stealc_tofsee.exe 87 PID 3124 wrote to memory of 4140 3124 3EE8.tmp 88 PID 4140 wrote to memory of 2696 4140 3FC3.tmp 89 PID 2696 wrote to memory of 1700 2696 40EC.tmp 90 PID 1700 wrote to memory of 4752 1700 4234.tmp 91 PID 4752 wrote to memory of 1716 4752 42FF.tmp 92 PID 1716 wrote to memory of 3232 1716 43F9.tmp 93 PID 3232 wrote to memory of 2576 3232 44B5.tmp 94 PID 2576 wrote to memory of 2644 2576 4590.tmp 95 PID 2644 wrote to memory of 3996 2644 463B.tmp 96 PID 3996 wrote to memory of 5116 3996 4716.tmp 97 PID 5116 wrote to memory of 1080 5116 4820.tmp 98 PID 1080 wrote to memory of 1564 1080 490A.tmp 99 PID 1564 wrote to memory of 4700 1564 4A04.tmp 100 PID 4700 wrote to memory of 4852 4700 4B0E.tmp 101 PID 4852 wrote to memory of 4508 4852 4BF8.tmp 102 PID 4508 wrote to memory of 3332 4508 4CE3.tmp 103 PID 3332 wrote to memory of 1180 3332 4DBD.tmp 104 PID 1180 wrote to memory of 3184 1180 4EB7.tmp 105 PID 3184 wrote to memory of 4172 3184 4F82.tmp 106 PID 4172 wrote to memory of 2368 4172 507C.tmp 107 PID 2368 wrote to memory of 2032 2368 5157.tmp 108 PID 2032 wrote to memory of 3008 2032 5203.tmp 109 PID 3008 wrote to memory of 60 3008 530D.tmp 110 PID 60 wrote to memory of 4468 60 53F7.tmp 111 PID 4468 wrote to memory of 1736 4468 54D2.tmp 112 PID 1736 wrote to memory of 752 1736 55AD.tmp 113 PID 752 wrote to memory of 2596 752 5687.tmp 114 PID 2596 wrote to memory of 2460 2596 5762.tmp 115 PID 2460 wrote to memory of 4044 2460 585C.tmp 116 PID 4044 wrote to memory of 744 4044 5975.tmp 117 PID 744 wrote to memory of 4352 744 5A6F.tmp 118 PID 4352 wrote to memory of 3092 4352 5B4A.tmp 119 PID 3092 wrote to memory of 2708 3092 5C25.tmp 120 PID 2708 wrote to memory of 836 2708 5CA2.tmp 121 PID 836 wrote to memory of 4800 836 5D1F.tmp 122 PID 4800 wrote to memory of 4728 4800 5D9C.tmp 123 PID 4728 wrote to memory of 612 4728 5E48.tmp 124 PID 612 wrote to memory of 3212 612 5EA5.tmp 125 PID 3212 wrote to memory of 1252 3212 5F51.tmp 126 PID 1252 wrote to memory of 1800 1252 5FCE.tmp 127 PID 1800 wrote to memory of 2800 1800 605B.tmp 128 PID 2800 wrote to memory of 2292 2800 60E8.tmp 129 PID 2292 wrote to memory of 4968 2292 6174.tmp 130 PID 4968 wrote to memory of 4220 4968 6201.tmp 131 PID 4220 wrote to memory of 1768 4220 629D.tmp 132 PID 1768 wrote to memory of 1364 1768 631A.tmp 133 PID 1364 wrote to memory of 3168 1364 63A7.tmp 134 PID 3168 wrote to memory of 3484 3168 6443.tmp 135 PID 3484 wrote to memory of 2920 3484 64B0.tmp 136 PID 2920 wrote to memory of 4384 2920 64FE.tmp 137 PID 4384 wrote to memory of 1852 4384 654D.tmp 138 PID 1852 wrote to memory of 4456 1852 659B.tmp 139 PID 4456 wrote to memory of 2856 4456 65E9.tmp 140 PID 2856 wrote to memory of 1824 2856 6647.tmp 141 PID 1824 wrote to memory of 3872 1824 66A4.tmp 143 PID 3872 wrote to memory of 1912 3872 6702.tmp 144 PID 1912 wrote to memory of 3796 1912 6750.tmp 145 PID 3796 wrote to memory of 4120 3796 679E.tmp 146 PID 4120 wrote to memory of 4708 4120 67EC.tmp 147 PID 4708 wrote to memory of 3816 4708 683B.tmp 148 PID 3816 wrote to memory of 2736 3816 6889.tmp 149 PID 2736 wrote to memory of 916 2736 68D7.tmp 150 PID 916 wrote to memory of 3384 916 6925.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-27_dc5fbca145b9a6d1949db54d2fa0577c_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-27_dc5fbca145b9a6d1949db54d2fa0577c_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"C:\Users\Admin\AppData\Local\Temp\3EE8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"C:\Users\Admin\AppData\Local\Temp\3FC3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\40EC.tmp"C:\Users\Admin\AppData\Local\Temp\40EC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\4234.tmp"C:\Users\Admin\AppData\Local\Temp\4234.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\42FF.tmp"C:\Users\Admin\AppData\Local\Temp\42FF.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\43F9.tmp"C:\Users\Admin\AppData\Local\Temp\43F9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\44B5.tmp"C:\Users\Admin\AppData\Local\Temp\44B5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\4590.tmp"C:\Users\Admin\AppData\Local\Temp\4590.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\463B.tmp"C:\Users\Admin\AppData\Local\Temp\463B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\4716.tmp"C:\Users\Admin\AppData\Local\Temp\4716.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\4820.tmp"C:\Users\Admin\AppData\Local\Temp\4820.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\490A.tmp"C:\Users\Admin\AppData\Local\Temp\490A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\4A04.tmp"C:\Users\Admin\AppData\Local\Temp\4A04.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\4BF8.tmp"C:\Users\Admin\AppData\Local\Temp\4BF8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\4EB7.tmp"C:\Users\Admin\AppData\Local\Temp\4EB7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\4F82.tmp"C:\Users\Admin\AppData\Local\Temp\4F82.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\507C.tmp"C:\Users\Admin\AppData\Local\Temp\507C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\5157.tmp"C:\Users\Admin\AppData\Local\Temp\5157.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\5203.tmp"C:\Users\Admin\AppData\Local\Temp\5203.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\530D.tmp"C:\Users\Admin\AppData\Local\Temp\530D.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\53F7.tmp"C:\Users\Admin\AppData\Local\Temp\53F7.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\54D2.tmp"C:\Users\Admin\AppData\Local\Temp\54D2.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\55AD.tmp"C:\Users\Admin\AppData\Local\Temp\55AD.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\5687.tmp"C:\Users\Admin\AppData\Local\Temp\5687.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\5762.tmp"C:\Users\Admin\AppData\Local\Temp\5762.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\585C.tmp"C:\Users\Admin\AppData\Local\Temp\585C.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\5975.tmp"C:\Users\Admin\AppData\Local\Temp\5975.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\5C25.tmp"C:\Users\Admin\AppData\Local\Temp\5C25.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\5D9C.tmp"C:\Users\Admin\AppData\Local\Temp\5D9C.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\5E48.tmp"C:\Users\Admin\AppData\Local\Temp\5E48.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Local\Temp\5F51.tmp"C:\Users\Admin\AppData\Local\Temp\5F51.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\605B.tmp"C:\Users\Admin\AppData\Local\Temp\605B.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\60E8.tmp"C:\Users\Admin\AppData\Local\Temp\60E8.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\6174.tmp"C:\Users\Admin\AppData\Local\Temp\6174.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\6201.tmp"C:\Users\Admin\AppData\Local\Temp\6201.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\629D.tmp"C:\Users\Admin\AppData\Local\Temp\629D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\631A.tmp"C:\Users\Admin\AppData\Local\Temp\631A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\63A7.tmp"C:\Users\Admin\AppData\Local\Temp\63A7.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\6443.tmp"C:\Users\Admin\AppData\Local\Temp\6443.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\64B0.tmp"C:\Users\Admin\AppData\Local\Temp\64B0.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\64FE.tmp"C:\Users\Admin\AppData\Local\Temp\64FE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\654D.tmp"C:\Users\Admin\AppData\Local\Temp\654D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\659B.tmp"C:\Users\Admin\AppData\Local\Temp\659B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\65E9.tmp"C:\Users\Admin\AppData\Local\Temp\65E9.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\6647.tmp"C:\Users\Admin\AppData\Local\Temp\6647.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\66A4.tmp"C:\Users\Admin\AppData\Local\Temp\66A4.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\6702.tmp"C:\Users\Admin\AppData\Local\Temp\6702.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\6750.tmp"C:\Users\Admin\AppData\Local\Temp\6750.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\679E.tmp"C:\Users\Admin\AppData\Local\Temp\679E.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\67EC.tmp"C:\Users\Admin\AppData\Local\Temp\67EC.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\683B.tmp"C:\Users\Admin\AppData\Local\Temp\683B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\6889.tmp"C:\Users\Admin\AppData\Local\Temp\6889.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\68D7.tmp"C:\Users\Admin\AppData\Local\Temp\68D7.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\6925.tmp"C:\Users\Admin\AppData\Local\Temp\6925.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\6973.tmp"C:\Users\Admin\AppData\Local\Temp\6973.tmp"65⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\69C1.tmp"C:\Users\Admin\AppData\Local\Temp\69C1.tmp"66⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"67⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"68⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\6ABB.tmp"C:\Users\Admin\AppData\Local\Temp\6ABB.tmp"69⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\6B09.tmp"C:\Users\Admin\AppData\Local\Temp\6B09.tmp"70⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\6B57.tmp"C:\Users\Admin\AppData\Local\Temp\6B57.tmp"71⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\6BB5.tmp"C:\Users\Admin\AppData\Local\Temp\6BB5.tmp"72⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\6C13.tmp"C:\Users\Admin\AppData\Local\Temp\6C13.tmp"73⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\6C71.tmp"C:\Users\Admin\AppData\Local\Temp\6C71.tmp"74⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"C:\Users\Admin\AppData\Local\Temp\6CBF.tmp"75⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"76⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"77⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"78⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"79⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\6E45.tmp"C:\Users\Admin\AppData\Local\Temp\6E45.tmp"80⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\6E94.tmp"C:\Users\Admin\AppData\Local\Temp\6E94.tmp"81⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"82⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\6F30.tmp"C:\Users\Admin\AppData\Local\Temp\6F30.tmp"83⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"C:\Users\Admin\AppData\Local\Temp\6F7E.tmp"84⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"85⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\701A.tmp"C:\Users\Admin\AppData\Local\Temp\701A.tmp"86⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\7068.tmp"C:\Users\Admin\AppData\Local\Temp\7068.tmp"87⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\70B6.tmp"C:\Users\Admin\AppData\Local\Temp\70B6.tmp"88⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\7105.tmp"C:\Users\Admin\AppData\Local\Temp\7105.tmp"89⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\7153.tmp"C:\Users\Admin\AppData\Local\Temp\7153.tmp"90⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\71A1.tmp"C:\Users\Admin\AppData\Local\Temp\71A1.tmp"91⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\71EF.tmp"C:\Users\Admin\AppData\Local\Temp\71EF.tmp"92⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\723D.tmp"C:\Users\Admin\AppData\Local\Temp\723D.tmp"93⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\728B.tmp"C:\Users\Admin\AppData\Local\Temp\728B.tmp"94⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\72D9.tmp"C:\Users\Admin\AppData\Local\Temp\72D9.tmp"95⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\7327.tmp"C:\Users\Admin\AppData\Local\Temp\7327.tmp"96⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\7376.tmp"C:\Users\Admin\AppData\Local\Temp\7376.tmp"97⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\73C4.tmp"C:\Users\Admin\AppData\Local\Temp\73C4.tmp"98⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\7421.tmp"C:\Users\Admin\AppData\Local\Temp\7421.tmp"99⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\7470.tmp"C:\Users\Admin\AppData\Local\Temp\7470.tmp"100⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\74BE.tmp"C:\Users\Admin\AppData\Local\Temp\74BE.tmp"101⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\750C.tmp"C:\Users\Admin\AppData\Local\Temp\750C.tmp"102⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\756A.tmp"C:\Users\Admin\AppData\Local\Temp\756A.tmp"103⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\75B8.tmp"C:\Users\Admin\AppData\Local\Temp\75B8.tmp"104⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\7606.tmp"C:\Users\Admin\AppData\Local\Temp\7606.tmp"105⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\7654.tmp"C:\Users\Admin\AppData\Local\Temp\7654.tmp"106⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\76A2.tmp"C:\Users\Admin\AppData\Local\Temp\76A2.tmp"107⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\76F0.tmp"C:\Users\Admin\AppData\Local\Temp\76F0.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\773E.tmp"C:\Users\Admin\AppData\Local\Temp\773E.tmp"109⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\77AC.tmp"C:\Users\Admin\AppData\Local\Temp\77AC.tmp"110⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\7809.tmp"C:\Users\Admin\AppData\Local\Temp\7809.tmp"111⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\7858.tmp"C:\Users\Admin\AppData\Local\Temp\7858.tmp"112⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\78A6.tmp"C:\Users\Admin\AppData\Local\Temp\78A6.tmp"113⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\78F4.tmp"C:\Users\Admin\AppData\Local\Temp\78F4.tmp"114⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\7942.tmp"C:\Users\Admin\AppData\Local\Temp\7942.tmp"115⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\7990.tmp"C:\Users\Admin\AppData\Local\Temp\7990.tmp"116⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\79DE.tmp"C:\Users\Admin\AppData\Local\Temp\79DE.tmp"117⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"118⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\7A7A.tmp"C:\Users\Admin\AppData\Local\Temp\7A7A.tmp"119⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\7AC9.tmp"C:\Users\Admin\AppData\Local\Temp\7AC9.tmp"120⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\7B26.tmp"C:\Users\Admin\AppData\Local\Temp\7B26.tmp"121⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\7B74.tmp"C:\Users\Admin\AppData\Local\Temp\7B74.tmp"122⤵PID:2720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-