Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/06/2026, 19:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-28_bd63794be8c7b49eef6e747ecd13b96b_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_bd63794be8c7b49eef6e747ecd13b96b_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260618-en
3 signatures
150 seconds
General
- Target 2026-06-28_bd63794be8c7b49eef6e747ecd13b96b_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260628-x5cefscv41
- SHA256 4342fbfdf5492e6580d80c4a1db49b244424bc08844b66410def655432ec8629
- MD5 bd63794be8c7b49eef6e747ecd13b96b
- SHA1 8ad81d1922cf83d6a17ed9c4a1e298d783917d02
- SHA512 1bbe1ce7642d47fdd59330af60e660aeef817634546ccf9c659ade7fe7b832965529f392ac70c850eb13cf866518f372231168b8d0546b9179888764892f4a24
- SSDEEP 12288:NU5rCOTeijm3D31gvA7Rrm7Q5Gg8JqO9tTZwlH:NUQOJjm3xgbQB8zTSlH
- TLSH T1BCB4F126B245C132E69312314BE6EBB26A3BBC35473664C33794A66D1FB42E1D778307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4560 600D.tmp 5572 608A.tmp 6032 60F7.tmp 2352 6155.tmp 5028 61C2.tmp 2980 623F.tmp 6132 62AD.tmp 5848 62EB.tmp 5652 6368.tmp 5708 63A7.tmp 5744 6404.tmp 5724 6472.tmp 5684 64DF.tmp 5772 653D.tmp 5832 657B.tmp 5900 65F8.tmp 5992 6666.tmp 5872 66B4.tmp 5268 6702.tmp 4860 6750.tmp 5924 67CD.tmp 6048 682B.tmp 5128 6869.tmp 4272 68C7.tmp 5844 6935.tmp 1776 6992.tmp 3820 69E0.tmp 3052 6A4E.tmp 2500 6AAC.tmp 2700 6B19.tmp 3092 6C13.tmp 3464 6C71.tmp 2556 6CDE.tmp 3512 6D1D.tmp 3448 6D5B.tmp 2324 6D9A.tmp 1684 6DD8.tmp 1232 6E36.tmp 2988 6E94.tmp 3600 6EE2.tmp 5196 6F20.tmp 3008 6F5F.tmp 1012 6FAD.tmp 5036 700B.tmp 1936 7068.tmp 312 70C6.tmp 1736 7114.tmp 3200 7172.tmp 4964 71C0.tmp 3800 720E.tmp 5252 724D.tmp 2612 729B.tmp 4644 72E9.tmp 1544 7347.tmp 5064 7395.tmp 716 73F3.tmp 2264 7441.tmp 4932 747F.tmp 3732 74DD.tmp 1564 751B.tmp 3928 756A.tmp 5280 75B8.tmp 2548 7606.tmp 4436 7664.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E327.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 934D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2754.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F18F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 166C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6750.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 386B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D983.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7352.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3744 wrote to memory of 4560 3744 2026-06-28_bd63794be8c7b49eef6e747ecd13b96b_elex_mafia_stealc_tofsee.exe 86 PID 4560 wrote to memory of 5572 4560 600D.tmp 87 PID 5572 wrote to memory of 6032 5572 608A.tmp 88 PID 6032 wrote to memory of 2352 6032 60F7.tmp 89 PID 2352 wrote to memory of 5028 2352 6155.tmp 90 PID 5028 wrote to memory of 2980 5028 61C2.tmp 91 PID 2980 wrote to memory of 6132 2980 623F.tmp 92 PID 6132 wrote to memory of 5848 6132 62AD.tmp 93 PID 5848 wrote to memory of 5652 5848 62EB.tmp 94 PID 5652 wrote to memory of 5708 5652 6368.tmp 95 PID 5708 wrote to memory of 5744 5708 63A7.tmp 96 PID 5744 wrote to memory of 5724 5744 6404.tmp 97 PID 5724 wrote to memory of 5684 5724 6472.tmp 98 PID 5684 wrote to memory of 5772 5684 64DF.tmp 99 PID 5772 wrote to memory of 5832 5772 653D.tmp 100 PID 5832 wrote to memory of 5900 5832 657B.tmp 101 PID 5900 wrote to memory of 5992 5900 65F8.tmp 102 PID 5992 wrote to memory of 5872 5992 6666.tmp 103 PID 5872 wrote to memory of 5268 5872 66B4.tmp 104 PID 5268 wrote to memory of 4860 5268 6702.tmp 105 PID 4860 wrote to memory of 5924 4860 6750.tmp 106 PID 5924 wrote to memory of 6048 5924 67CD.tmp 107 PID 6048 wrote to memory of 5128 6048 682B.tmp 108 PID 5128 wrote to memory of 4272 5128 6869.tmp 109 PID 4272 wrote to memory of 5844 4272 68C7.tmp 110 PID 5844 wrote to memory of 1776 5844 6935.tmp 111 PID 1776 wrote to memory of 3820 1776 6992.tmp 112 PID 3820 wrote to memory of 3052 3820 69E0.tmp 113 PID 3052 wrote to memory of 2500 3052 6A4E.tmp 114 PID 2500 wrote to memory of 2700 2500 6AAC.tmp 115 PID 2700 wrote to memory of 3092 2700 6B19.tmp 116 PID 3092 wrote to memory of 3464 3092 6C13.tmp 118 PID 3464 wrote to memory of 2556 3464 6C71.tmp 119 PID 2556 wrote to memory of 3512 2556 6CDE.tmp 120 PID 3512 wrote to memory of 3448 3512 6D1D.tmp 121 PID 3448 wrote to memory of 2324 3448 6D5B.tmp 122 PID 2324 wrote to memory of 1684 2324 6D9A.tmp 123 PID 1684 wrote to memory of 1232 1684 6DD8.tmp 124 PID 1232 wrote to memory of 2988 1232 6E36.tmp 125 PID 2988 wrote to memory of 3600 2988 6E94.tmp 126 PID 3600 wrote to memory of 5196 3600 6EE2.tmp 127 PID 5196 wrote to memory of 3008 5196 6F20.tmp 128 PID 3008 wrote to memory of 1012 3008 6F5F.tmp 129 PID 1012 wrote to memory of 5036 1012 6FAD.tmp 130 PID 5036 wrote to memory of 1936 5036 700B.tmp 131 PID 1936 wrote to memory of 312 1936 7068.tmp 132 PID 312 wrote to memory of 1736 312 70C6.tmp 133 PID 1736 wrote to memory of 3200 1736 7114.tmp 134 PID 3200 wrote to memory of 4964 3200 7172.tmp 135 PID 4964 wrote to memory of 3800 4964 71C0.tmp 136 PID 3800 wrote to memory of 5252 3800 720E.tmp 137 PID 5252 wrote to memory of 2612 5252 724D.tmp 138 PID 2612 wrote to memory of 4644 2612 729B.tmp 139 PID 4644 wrote to memory of 1544 4644 72E9.tmp 140 PID 1544 wrote to memory of 5064 1544 7347.tmp 141 PID 5064 wrote to memory of 716 5064 7395.tmp 142 PID 716 wrote to memory of 2264 716 73F3.tmp 143 PID 2264 wrote to memory of 4932 2264 7441.tmp 144 PID 4932 wrote to memory of 3732 4932 747F.tmp 145 PID 3732 wrote to memory of 1564 3732 74DD.tmp 146 PID 1564 wrote to memory of 3928 1564 751B.tmp 147 PID 3928 wrote to memory of 5280 3928 756A.tmp 148 PID 5280 wrote to memory of 2548 5280 75B8.tmp 149 PID 2548 wrote to memory of 4436 2548 7606.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-28_bd63794be8c7b49eef6e747ecd13b96b_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-28_bd63794be8c7b49eef6e747ecd13b96b_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\600D.tmp"C:\Users\Admin\AppData\Local\Temp\600D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\608A.tmp"C:\Users\Admin\AppData\Local\Temp\608A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\60F7.tmp"C:\Users\Admin\AppData\Local\Temp\60F7.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\6155.tmp"C:\Users\Admin\AppData\Local\Temp\6155.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\61C2.tmp"C:\Users\Admin\AppData\Local\Temp\61C2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\623F.tmp"C:\Users\Admin\AppData\Local\Temp\623F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\62AD.tmp"C:\Users\Admin\AppData\Local\Temp\62AD.tmp"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\62EB.tmp"C:\Users\Admin\AppData\Local\Temp\62EB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5848 -
C:\Users\Admin\AppData\Local\Temp\6368.tmp"C:\Users\Admin\AppData\Local\Temp\6368.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\63A7.tmp"C:\Users\Admin\AppData\Local\Temp\63A7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\6404.tmp"C:\Users\Admin\AppData\Local\Temp\6404.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
C:\Users\Admin\AppData\Local\Temp\6472.tmp"C:\Users\Admin\AppData\Local\Temp\6472.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\64DF.tmp"C:\Users\Admin\AppData\Local\Temp\64DF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\653D.tmp"C:\Users\Admin\AppData\Local\Temp\653D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Users\Admin\AppData\Local\Temp\657B.tmp"C:\Users\Admin\AppData\Local\Temp\657B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\65F8.tmp"C:\Users\Admin\AppData\Local\Temp\65F8.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\6666.tmp"C:\Users\Admin\AppData\Local\Temp\6666.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\66B4.tmp"C:\Users\Admin\AppData\Local\Temp\66B4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Users\Admin\AppData\Local\Temp\6702.tmp"C:\Users\Admin\AppData\Local\Temp\6702.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5268 -
C:\Users\Admin\AppData\Local\Temp\6750.tmp"C:\Users\Admin\AppData\Local\Temp\6750.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\67CD.tmp"C:\Users\Admin\AppData\Local\Temp\67CD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\682B.tmp"C:\Users\Admin\AppData\Local\Temp\682B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\6869.tmp"C:\Users\Admin\AppData\Local\Temp\6869.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\68C7.tmp"C:\Users\Admin\AppData\Local\Temp\68C7.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\6935.tmp"C:\Users\Admin\AppData\Local\Temp\6935.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5844 -
C:\Users\Admin\AppData\Local\Temp\6992.tmp"C:\Users\Admin\AppData\Local\Temp\6992.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\69E0.tmp"C:\Users\Admin\AppData\Local\Temp\69E0.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\6A4E.tmp"C:\Users\Admin\AppData\Local\Temp\6A4E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\6B19.tmp"C:\Users\Admin\AppData\Local\Temp\6B19.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\6C13.tmp"C:\Users\Admin\AppData\Local\Temp\6C13.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\6C71.tmp"C:\Users\Admin\AppData\Local\Temp\6C71.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\6D9A.tmp"C:\Users\Admin\AppData\Local\Temp\6D9A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\6DD8.tmp"C:\Users\Admin\AppData\Local\Temp\6DD8.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\6E36.tmp"C:\Users\Admin\AppData\Local\Temp\6E36.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\6E94.tmp"C:\Users\Admin\AppData\Local\Temp\6E94.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\6F20.tmp"C:\Users\Admin\AppData\Local\Temp\6F20.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"C:\Users\Admin\AppData\Local\Temp\6F5F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\6FAD.tmp"C:\Users\Admin\AppData\Local\Temp\6FAD.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\700B.tmp"C:\Users\Admin\AppData\Local\Temp\700B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\7068.tmp"C:\Users\Admin\AppData\Local\Temp\7068.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\70C6.tmp"C:\Users\Admin\AppData\Local\Temp\70C6.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\7114.tmp"C:\Users\Admin\AppData\Local\Temp\7114.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\7172.tmp"C:\Users\Admin\AppData\Local\Temp\7172.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\71C0.tmp"C:\Users\Admin\AppData\Local\Temp\71C0.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\720E.tmp"C:\Users\Admin\AppData\Local\Temp\720E.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\724D.tmp"C:\Users\Admin\AppData\Local\Temp\724D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\729B.tmp"C:\Users\Admin\AppData\Local\Temp\729B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\72E9.tmp"C:\Users\Admin\AppData\Local\Temp\72E9.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\7347.tmp"C:\Users\Admin\AppData\Local\Temp\7347.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\7395.tmp"C:\Users\Admin\AppData\Local\Temp\7395.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\73F3.tmp"C:\Users\Admin\AppData\Local\Temp\73F3.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Users\Admin\AppData\Local\Temp\7441.tmp"C:\Users\Admin\AppData\Local\Temp\7441.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\747F.tmp"C:\Users\Admin\AppData\Local\Temp\747F.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\74DD.tmp"C:\Users\Admin\AppData\Local\Temp\74DD.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\751B.tmp"C:\Users\Admin\AppData\Local\Temp\751B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\756A.tmp"C:\Users\Admin\AppData\Local\Temp\756A.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\75B8.tmp"C:\Users\Admin\AppData\Local\Temp\75B8.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\7606.tmp"C:\Users\Admin\AppData\Local\Temp\7606.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\7664.tmp"C:\Users\Admin\AppData\Local\Temp\7664.tmp"65⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\76A2.tmp"C:\Users\Admin\AppData\Local\Temp\76A2.tmp"66⤵PID:5552
-
C:\Users\Admin\AppData\Local\Temp\76F0.tmp"C:\Users\Admin\AppData\Local\Temp\76F0.tmp"67⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\773E.tmp"C:\Users\Admin\AppData\Local\Temp\773E.tmp"68⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\778C.tmp"C:\Users\Admin\AppData\Local\Temp\778C.tmp"69⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\77CB.tmp"C:\Users\Admin\AppData\Local\Temp\77CB.tmp"70⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\7819.tmp"C:\Users\Admin\AppData\Local\Temp\7819.tmp"71⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\7867.tmp"C:\Users\Admin\AppData\Local\Temp\7867.tmp"72⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\78B5.tmp"C:\Users\Admin\AppData\Local\Temp\78B5.tmp"73⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\78F4.tmp"C:\Users\Admin\AppData\Local\Temp\78F4.tmp"74⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\7942.tmp"C:\Users\Admin\AppData\Local\Temp\7942.tmp"75⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\7990.tmp"C:\Users\Admin\AppData\Local\Temp\7990.tmp"76⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\79DE.tmp"C:\Users\Admin\AppData\Local\Temp\79DE.tmp"77⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\7A1D.tmp"C:\Users\Admin\AppData\Local\Temp\7A1D.tmp"78⤵PID:5232
-
C:\Users\Admin\AppData\Local\Temp\7A6B.tmp"C:\Users\Admin\AppData\Local\Temp\7A6B.tmp"79⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\7AC9.tmp"C:\Users\Admin\AppData\Local\Temp\7AC9.tmp"80⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\7B07.tmp"C:\Users\Admin\AppData\Local\Temp\7B07.tmp"81⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\7B55.tmp"C:\Users\Admin\AppData\Local\Temp\7B55.tmp"82⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\7BA3.tmp"C:\Users\Admin\AppData\Local\Temp\7BA3.tmp"83⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\7BE2.tmp"C:\Users\Admin\AppData\Local\Temp\7BE2.tmp"84⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\7C20.tmp"C:\Users\Admin\AppData\Local\Temp\7C20.tmp"85⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"86⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\7CBD.tmp"C:\Users\Admin\AppData\Local\Temp\7CBD.tmp"87⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"88⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\7D59.tmp"C:\Users\Admin\AppData\Local\Temp\7D59.tmp"89⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"90⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\7DF5.tmp"C:\Users\Admin\AppData\Local\Temp\7DF5.tmp"91⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\7E34.tmp"C:\Users\Admin\AppData\Local\Temp\7E34.tmp"92⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\7E91.tmp"C:\Users\Admin\AppData\Local\Temp\7E91.tmp"93⤵PID:5532
-
C:\Users\Admin\AppData\Local\Temp\7ED0.tmp"C:\Users\Admin\AppData\Local\Temp\7ED0.tmp"94⤵PID:5360
-
C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"95⤵PID:5436
-
C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"96⤵PID:5544
-
C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"97⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\8008.tmp"C:\Users\Admin\AppData\Local\Temp\8008.tmp"98⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\8056.tmp"C:\Users\Admin\AppData\Local\Temp\8056.tmp"99⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\80B4.tmp"C:\Users\Admin\AppData\Local\Temp\80B4.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:5324 -
C:\Users\Admin\AppData\Local\Temp\8102.tmp"C:\Users\Admin\AppData\Local\Temp\8102.tmp"101⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"102⤵PID:5700
-
C:\Users\Admin\AppData\Local\Temp\819F.tmp"C:\Users\Admin\AppData\Local\Temp\819F.tmp"103⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"104⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\822B.tmp"C:\Users\Admin\AppData\Local\Temp\822B.tmp"105⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"106⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\82C7.tmp"C:\Users\Admin\AppData\Local\Temp\82C7.tmp"107⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\8316.tmp"C:\Users\Admin\AppData\Local\Temp\8316.tmp"108⤵PID:5712
-
C:\Users\Admin\AppData\Local\Temp\8373.tmp"C:\Users\Admin\AppData\Local\Temp\8373.tmp"109⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\83B2.tmp"C:\Users\Admin\AppData\Local\Temp\83B2.tmp"110⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\8410.tmp"C:\Users\Admin\AppData\Local\Temp\8410.tmp"111⤵PID:5692
-
C:\Users\Admin\AppData\Local\Temp\845E.tmp"C:\Users\Admin\AppData\Local\Temp\845E.tmp"112⤵PID:5776
-
C:\Users\Admin\AppData\Local\Temp\84BB.tmp"C:\Users\Admin\AppData\Local\Temp\84BB.tmp"113⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\84FA.tmp"C:\Users\Admin\AppData\Local\Temp\84FA.tmp"114⤵PID:5764
-
C:\Users\Admin\AppData\Local\Temp\8558.tmp"C:\Users\Admin\AppData\Local\Temp\8558.tmp"115⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\85B5.tmp"C:\Users\Admin\AppData\Local\Temp\85B5.tmp"116⤵PID:5580
-
C:\Users\Admin\AppData\Local\Temp\8613.tmp"C:\Users\Admin\AppData\Local\Temp\8613.tmp"117⤵PID:5960
-
C:\Users\Admin\AppData\Local\Temp\8661.tmp"C:\Users\Admin\AppData\Local\Temp\8661.tmp"118⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\86AF.tmp"C:\Users\Admin\AppData\Local\Temp\86AF.tmp"119⤵PID:5860
-
C:\Users\Admin\AppData\Local\Temp\86EE.tmp"C:\Users\Admin\AppData\Local\Temp\86EE.tmp"120⤵PID:5988
-
C:\Users\Admin\AppData\Local\Temp\872C.tmp"C:\Users\Admin\AppData\Local\Temp\872C.tmp"121⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\877B.tmp"C:\Users\Admin\AppData\Local\Temp\877B.tmp"122⤵PID:6100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-