Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 04:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_98b4b96c5b1e71f71ba5dab129a7356a_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_98b4b96c5b1e71f71ba5dab129a7356a_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-07-28_98b4b96c5b1e71f71ba5dab129a7356a_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260728-e8rdnsyame
- SHA256 ec4c073a7ce6433775cd6c54e4e85a2213c1996286afe90506fe9667038ccd92
- MD5 98b4b96c5b1e71f71ba5dab129a7356a
- SHA1 a52a41073f91be58b3aceeaa9ad8ab8e7683848b
- SHA512 5382531ad6bb3c001b6eef027a1aba42677caadd5518f0cc2a924f79a299348fc82713c2a7b459b8149a7e70ca1c65b41ead4f445355d0dd5de51e88e62a4727
- SSDEEP 12288:wU5rCOTeiDrlLApXBAtwuP+8fV/UJxDZmNZ+3/v+I9hUG2VA:wUQOJDBRwuL6xDZmNGEA
- TLSH T172E4C02177D88532E9FB037859B5B6604D7EBD326722D6CF2F8012AE1971BC09A71723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 932 4793.tmp 4700 486E.tmp 4800 4978.tmp 4412 4AB0.tmp 388 4B9A.tmp 1004 4CD3.tmp 8 4E1B.tmp 3224 4F54.tmp 4248 501F.tmp 2172 50F9.tmp 4428 51D4.tmp 860 52CE.tmp 2372 53F7.tmp 1984 54D2.tmp 1460 55AD.tmp 2100 56E5.tmp 4176 57C0.tmp 3272 58D9.tmp 624 59E3.tmp 1816 5ADD.tmp 1896 5C06.tmp 1300 5CD1.tmp 3860 5E09.tmp 3816 5EE4.tmp 1792 5FDE.tmp 4692 6107.tmp 3580 6230.tmp 612 631A.tmp 2800 6453.tmp 4396 651E.tmp 2656 6627.tmp 3928 66E3.tmp 556 67CD.tmp 3748 684A.tmp 4228 68E6.tmp 1676 6973.tmp 5116 6A00.tmp 4680 6A9C.tmp 4216 6B09.tmp 4620 6BB5.tmp 3156 6C32.tmp 3300 6CA0.tmp 4980 6D4B.tmp 5060 6DB9.tmp 5028 6E26.tmp 1828 6EC2.tmp 2368 6F4F.tmp 1696 6FEB.tmp 3196 7049.tmp 4908 7097.tmp 4584 70E5.tmp 208 7143.tmp 1740 7191.tmp 4232 71DF.tmp 3364 723D.tmp 780 728B.tmp 4384 72E9.tmp 2616 7347.tmp 2916 73B4.tmp 3776 7402.tmp 1496 7450.tmp 1764 749E.tmp 1824 74ED.tmp 3852 754A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A241.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7402.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8865.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7952.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9507.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F671.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 381D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CD5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B820.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6269.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B368.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8548.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE07.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 698E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4608.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 742C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72C5.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 932 2400 2026-07-28_98b4b96c5b1e71f71ba5dab129a7356a_elex_mafia_stealc_tofsee.exe 84 PID 932 wrote to memory of 4700 932 4793.tmp 85 PID 4700 wrote to memory of 4800 4700 486E.tmp 86 PID 4800 wrote to memory of 4412 4800 4978.tmp 87 PID 4412 wrote to memory of 388 4412 4AB0.tmp 88 PID 388 wrote to memory of 1004 388 4B9A.tmp 89 PID 1004 wrote to memory of 8 1004 4CD3.tmp 90 PID 8 wrote to memory of 3224 8 4E1B.tmp 91 PID 3224 wrote to memory of 4248 3224 4F54.tmp 92 PID 4248 wrote to memory of 2172 4248 501F.tmp 93 PID 2172 wrote to memory of 4428 2172 50F9.tmp 94 PID 4428 wrote to memory of 860 4428 51D4.tmp 95 PID 860 wrote to memory of 2372 860 52CE.tmp 96 PID 2372 wrote to memory of 1984 2372 53F7.tmp 97 PID 1984 wrote to memory of 1460 1984 54D2.tmp 98 PID 1460 wrote to memory of 2100 1460 55AD.tmp 101 PID 2100 wrote to memory of 4176 2100 56E5.tmp 102 PID 4176 wrote to memory of 3272 4176 57C0.tmp 103 PID 3272 wrote to memory of 624 3272 58D9.tmp 104 PID 624 wrote to memory of 1816 624 59E3.tmp 106 PID 1816 wrote to memory of 1896 1816 5ADD.tmp 107 PID 1896 wrote to memory of 1300 1896 5C06.tmp 109 PID 1300 wrote to memory of 3860 1300 5CD1.tmp 110 PID 3860 wrote to memory of 3816 3860 5E09.tmp 111 PID 3816 wrote to memory of 1792 3816 5EE4.tmp 112 PID 1792 wrote to memory of 4692 1792 5FDE.tmp 113 PID 4692 wrote to memory of 3580 4692 6107.tmp 114 PID 3580 wrote to memory of 612 3580 6230.tmp 115 PID 612 wrote to memory of 2800 612 631A.tmp 116 PID 2800 wrote to memory of 4396 2800 6453.tmp 118 PID 4396 wrote to memory of 2656 4396 651E.tmp 119 PID 2656 wrote to memory of 3928 2656 6627.tmp 120 PID 3928 wrote to memory of 556 3928 66E3.tmp 122 PID 556 wrote to memory of 3748 556 67CD.tmp 123 PID 3748 wrote to memory of 4228 3748 684A.tmp 124 PID 4228 wrote to memory of 1676 4228 68E6.tmp 126 PID 1676 wrote to memory of 5116 1676 6973.tmp 127 PID 5116 wrote to memory of 4680 5116 6A00.tmp 128 PID 4680 wrote to memory of 4216 4680 6A9C.tmp 131 PID 4216 wrote to memory of 4620 4216 6B09.tmp 132 PID 4620 wrote to memory of 3156 4620 6BB5.tmp 134 PID 3156 wrote to memory of 3300 3156 6C32.tmp 135 PID 3300 wrote to memory of 4980 3300 6CA0.tmp 136 PID 4980 wrote to memory of 5060 4980 6D4B.tmp 137 PID 5060 wrote to memory of 5028 5060 6DB9.tmp 138 PID 5028 wrote to memory of 1828 5028 6E26.tmp 139 PID 1828 wrote to memory of 2368 1828 6EC2.tmp 140 PID 2368 wrote to memory of 1696 2368 6F4F.tmp 141 PID 1696 wrote to memory of 3196 1696 6FEB.tmp 142 PID 3196 wrote to memory of 4908 3196 7049.tmp 143 PID 4908 wrote to memory of 4584 4908 7097.tmp 144 PID 4584 wrote to memory of 208 4584 70E5.tmp 145 PID 208 wrote to memory of 1740 208 7143.tmp 146 PID 1740 wrote to memory of 4232 1740 7191.tmp 147 PID 4232 wrote to memory of 3364 4232 71DF.tmp 148 PID 3364 wrote to memory of 780 3364 723D.tmp 149 PID 780 wrote to memory of 4384 780 728B.tmp 150 PID 4384 wrote to memory of 2616 4384 72E9.tmp 151 PID 2616 wrote to memory of 2916 2616 7347.tmp 154 PID 2916 wrote to memory of 3776 2916 73B4.tmp 155 PID 3776 wrote to memory of 1496 3776 7402.tmp 156 PID 1496 wrote to memory of 1764 1496 7450.tmp 157 PID 1764 wrote to memory of 1824 1764 749E.tmp 158 PID 1824 wrote to memory of 3852 1824 74ED.tmp 159
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_98b4b96c5b1e71f71ba5dab129a7356a_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_98b4b96c5b1e71f71ba5dab129a7356a_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\486E.tmp"C:\Users\Admin\AppData\Local\Temp\486E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\4978.tmp"C:\Users\Admin\AppData\Local\Temp\4978.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"C:\Users\Admin\AppData\Local\Temp\4AB0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\4CD3.tmp"C:\Users\Admin\AppData\Local\Temp\4CD3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\4F54.tmp"C:\Users\Admin\AppData\Local\Temp\4F54.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\501F.tmp"C:\Users\Admin\AppData\Local\Temp\501F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\50F9.tmp"C:\Users\Admin\AppData\Local\Temp\50F9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\51D4.tmp"C:\Users\Admin\AppData\Local\Temp\51D4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\52CE.tmp"C:\Users\Admin\AppData\Local\Temp\52CE.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\53F7.tmp"C:\Users\Admin\AppData\Local\Temp\53F7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\54D2.tmp"C:\Users\Admin\AppData\Local\Temp\54D2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\55AD.tmp"C:\Users\Admin\AppData\Local\Temp\55AD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\56E5.tmp"C:\Users\Admin\AppData\Local\Temp\56E5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\57C0.tmp"C:\Users\Admin\AppData\Local\Temp\57C0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\58D9.tmp"C:\Users\Admin\AppData\Local\Temp\58D9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\59E3.tmp"C:\Users\Admin\AppData\Local\Temp\59E3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\5C06.tmp"C:\Users\Admin\AppData\Local\Temp\5C06.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"C:\Users\Admin\AppData\Local\Temp\5CD1.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\5E09.tmp"C:\Users\Admin\AppData\Local\Temp\5E09.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\6107.tmp"C:\Users\Admin\AppData\Local\Temp\6107.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\6230.tmp"C:\Users\Admin\AppData\Local\Temp\6230.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\631A.tmp"C:\Users\Admin\AppData\Local\Temp\631A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Local\Temp\6453.tmp"C:\Users\Admin\AppData\Local\Temp\6453.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\651E.tmp"C:\Users\Admin\AppData\Local\Temp\651E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\6627.tmp"C:\Users\Admin\AppData\Local\Temp\6627.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\66E3.tmp"C:\Users\Admin\AppData\Local\Temp\66E3.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\67CD.tmp"C:\Users\Admin\AppData\Local\Temp\67CD.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\684A.tmp"C:\Users\Admin\AppData\Local\Temp\684A.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\68E6.tmp"C:\Users\Admin\AppData\Local\Temp\68E6.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\6973.tmp"C:\Users\Admin\AppData\Local\Temp\6973.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\6A00.tmp"C:\Users\Admin\AppData\Local\Temp\6A00.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\6A9C.tmp"C:\Users\Admin\AppData\Local\Temp\6A9C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\6B09.tmp"C:\Users\Admin\AppData\Local\Temp\6B09.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\6BB5.tmp"C:\Users\Admin\AppData\Local\Temp\6BB5.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\6C32.tmp"C:\Users\Admin\AppData\Local\Temp\6C32.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\6DB9.tmp"C:\Users\Admin\AppData\Local\Temp\6DB9.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\6E26.tmp"C:\Users\Admin\AppData\Local\Temp\6E26.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\6F4F.tmp"C:\Users\Admin\AppData\Local\Temp\6F4F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\6FEB.tmp"C:\Users\Admin\AppData\Local\Temp\6FEB.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\7049.tmp"C:\Users\Admin\AppData\Local\Temp\7049.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\7097.tmp"C:\Users\Admin\AppData\Local\Temp\7097.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\70E5.tmp"C:\Users\Admin\AppData\Local\Temp\70E5.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\7143.tmp"C:\Users\Admin\AppData\Local\Temp\7143.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\7191.tmp"C:\Users\Admin\AppData\Local\Temp\7191.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\71DF.tmp"C:\Users\Admin\AppData\Local\Temp\71DF.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\723D.tmp"C:\Users\Admin\AppData\Local\Temp\723D.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\728B.tmp"C:\Users\Admin\AppData\Local\Temp\728B.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\72E9.tmp"C:\Users\Admin\AppData\Local\Temp\72E9.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\7347.tmp"C:\Users\Admin\AppData\Local\Temp\7347.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\73B4.tmp"C:\Users\Admin\AppData\Local\Temp\73B4.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\7402.tmp"C:\Users\Admin\AppData\Local\Temp\7402.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\7450.tmp"C:\Users\Admin\AppData\Local\Temp\7450.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\749E.tmp"C:\Users\Admin\AppData\Local\Temp\749E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\74ED.tmp"C:\Users\Admin\AppData\Local\Temp\74ED.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\754A.tmp"C:\Users\Admin\AppData\Local\Temp\754A.tmp"65⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\7598.tmp"C:\Users\Admin\AppData\Local\Temp\7598.tmp"66⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\75E7.tmp"C:\Users\Admin\AppData\Local\Temp\75E7.tmp"67⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\7635.tmp"C:\Users\Admin\AppData\Local\Temp\7635.tmp"68⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\7683.tmp"C:\Users\Admin\AppData\Local\Temp\7683.tmp"69⤵PID:516
-
C:\Users\Admin\AppData\Local\Temp\76D1.tmp"C:\Users\Admin\AppData\Local\Temp\76D1.tmp"70⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\771F.tmp"C:\Users\Admin\AppData\Local\Temp\771F.tmp"71⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\776D.tmp"C:\Users\Admin\AppData\Local\Temp\776D.tmp"72⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\77BB.tmp"C:\Users\Admin\AppData\Local\Temp\77BB.tmp"73⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\7819.tmp"C:\Users\Admin\AppData\Local\Temp\7819.tmp"74⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\7867.tmp"C:\Users\Admin\AppData\Local\Temp\7867.tmp"75⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\78B5.tmp"C:\Users\Admin\AppData\Local\Temp\78B5.tmp"76⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\7903.tmp"C:\Users\Admin\AppData\Local\Temp\7903.tmp"77⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\7952.tmp"C:\Users\Admin\AppData\Local\Temp\7952.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\79A0.tmp"C:\Users\Admin\AppData\Local\Temp\79A0.tmp"79⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\79EE.tmp"C:\Users\Admin\AppData\Local\Temp\79EE.tmp"80⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\7A3C.tmp"C:\Users\Admin\AppData\Local\Temp\7A3C.tmp"81⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"82⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"83⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\7B36.tmp"C:\Users\Admin\AppData\Local\Temp\7B36.tmp"84⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\7B84.tmp"C:\Users\Admin\AppData\Local\Temp\7B84.tmp"85⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\7BD2.tmp"C:\Users\Admin\AppData\Local\Temp\7BD2.tmp"86⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\7C20.tmp"C:\Users\Admin\AppData\Local\Temp\7C20.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"88⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\7CBD.tmp"C:\Users\Admin\AppData\Local\Temp\7CBD.tmp"89⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"90⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\7D59.tmp"C:\Users\Admin\AppData\Local\Temp\7D59.tmp"91⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"C:\Users\Admin\AppData\Local\Temp\7DA7.tmp"92⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\7E05.tmp"C:\Users\Admin\AppData\Local\Temp\7E05.tmp"93⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\7E53.tmp"C:\Users\Admin\AppData\Local\Temp\7E53.tmp"94⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"95⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\7EEF.tmp"C:\Users\Admin\AppData\Local\Temp\7EEF.tmp"96⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"97⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"C:\Users\Admin\AppData\Local\Temp\7F9B.tmp"98⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"99⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"100⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\8085.tmp"C:\Users\Admin\AppData\Local\Temp\8085.tmp"101⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"102⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\8131.tmp"C:\Users\Admin\AppData\Local\Temp\8131.tmp"103⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"104⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"105⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\822B.tmp"C:\Users\Admin\AppData\Local\Temp\822B.tmp"106⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"107⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\82C7.tmp"C:\Users\Admin\AppData\Local\Temp\82C7.tmp"108⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\8316.tmp"C:\Users\Admin\AppData\Local\Temp\8316.tmp"109⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\8364.tmp"C:\Users\Admin\AppData\Local\Temp\8364.tmp"110⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\83B2.tmp"C:\Users\Admin\AppData\Local\Temp\83B2.tmp"111⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\8400.tmp"C:\Users\Admin\AppData\Local\Temp\8400.tmp"112⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\844E.tmp"C:\Users\Admin\AppData\Local\Temp\844E.tmp"113⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\849C.tmp"C:\Users\Admin\AppData\Local\Temp\849C.tmp"114⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\84FA.tmp"C:\Users\Admin\AppData\Local\Temp\84FA.tmp"115⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\8548.tmp"C:\Users\Admin\AppData\Local\Temp\8548.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\8596.tmp"C:\Users\Admin\AppData\Local\Temp\8596.tmp"117⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\85E4.tmp"C:\Users\Admin\AppData\Local\Temp\85E4.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\8632.tmp"C:\Users\Admin\AppData\Local\Temp\8632.tmp"119⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\8681.tmp"C:\Users\Admin\AppData\Local\Temp\8681.tmp"120⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\86CF.tmp"C:\Users\Admin\AppData\Local\Temp\86CF.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\871D.tmp"C:\Users\Admin\AppData\Local\Temp\871D.tmp"122⤵PID:4288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-