Analysis
- max time kernel
150s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 03:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_000591b70e4af6a3af1719ecda4c9971_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_000591b70e4af6a3af1719ecda4c9971_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_000591b70e4af6a3af1719ecda4c9971_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260802-eb9hzstepf
- SHA256 a3c13fe09611fc1626bd935daab9b270bb8b4b3d62079fde76c721265b577039
- MD5 000591b70e4af6a3af1719ecda4c9971
- SHA1 e9667cc602b6dcf0b571242a7d0e5060e83c6253
- SHA512 c93162e3227df9744c123aaa1a426573084e997e69b70e7f2516a6cca16097274fa5a5b0097b77414995db131193b1867f2c8e4330f88ef9b4f0497f1ce91ba7
- SSDEEP 12288:wU5rCOTeiDujrFdDqFI2y7jCt6lgxp9s1GGXNZ+3/v+I9hUG2VA:wUQOJDufFJCI546lksAGXNGEA
- TLSH T1D9E4E12173D8C536E5FB037859B5E660497EBD266722D6CF2F8016BE0AB1BC08631763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4704 4496.tmp 1640 4590.tmp 3968 46B8.tmp 3816 47F1.tmp 5004 48FB.tmp 1376 4A14.tmp 4752 4AFE.tmp 660 4BD9.tmp 3928 4CE3.tmp 1116 4EE6.tmp 2312 4FF0.tmp 3300 50DA.tmp 2052 51C5.tmp 1348 52AF.tmp 632 538A.tmp 116 5484.tmp 4828 558D.tmp 3228 5687.tmp 4496 57A1.tmp 2116 587B.tmp 2908 5966.tmp 4604 5A6F.tmp 2092 5B5A.tmp 384 5C44.tmp 1968 5D3E.tmp 2300 5E38.tmp 2920 5F13.tmp 3796 5FFD.tmp 3948 60E8.tmp 4884 61F1.tmp 3860 62EB.tmp 1180 63B6.tmp 2848 64A1.tmp 312 653D.tmp 3296 65CA.tmp 2972 6675.tmp 880 6702.tmp 3668 679E.tmp 2056 681B.tmp 4684 68B8.tmp 2224 6954.tmp 4860 69D1.tmp 2804 6A5D.tmp 4208 6AFA.tmp 4920 6B96.tmp 3432 6C13.tmp 3840 6CAF.tmp 2252 6D3C.tmp 3752 6D9A.tmp 2084 6DE8.tmp 4152 6E36.tmp 2608 6E84.tmp 2040 6ED2.tmp 4252 6F20.tmp 4580 6F6E.tmp 620 6FBC.tmp 4544 700B.tmp 2772 7059.tmp 2520 70B6.tmp 3652 7105.tmp 3484 7153.tmp 4716 71A1.tmp 5020 71EF.tmp 1520 723D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 906F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8529.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E21E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 401C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A246.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A63E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1803.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 971B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F22B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A052.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A01E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9239.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A34B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4408 wrote to memory of 4704 4408 2026-08-02_000591b70e4af6a3af1719ecda4c9971_elex_mafia_stealc_tofsee.exe 87 PID 4704 wrote to memory of 1640 4704 4496.tmp 88 PID 1640 wrote to memory of 3968 1640 4590.tmp 89 PID 3968 wrote to memory of 3816 3968 46B8.tmp 90 PID 3816 wrote to memory of 5004 3816 47F1.tmp 91 PID 5004 wrote to memory of 1376 5004 48FB.tmp 92 PID 1376 wrote to memory of 4752 1376 4A14.tmp 93 PID 4752 wrote to memory of 660 4752 4AFE.tmp 94 PID 660 wrote to memory of 3928 660 4BD9.tmp 95 PID 3928 wrote to memory of 1116 3928 4CE3.tmp 96 PID 1116 wrote to memory of 2312 1116 4EE6.tmp 97 PID 2312 wrote to memory of 3300 2312 4FF0.tmp 98 PID 3300 wrote to memory of 2052 3300 50DA.tmp 99 PID 2052 wrote to memory of 1348 2052 51C5.tmp 100 PID 1348 wrote to memory of 632 1348 52AF.tmp 101 PID 632 wrote to memory of 116 632 538A.tmp 102 PID 116 wrote to memory of 4828 116 5484.tmp 103 PID 4828 wrote to memory of 3228 4828 558D.tmp 104 PID 3228 wrote to memory of 4496 3228 5687.tmp 105 PID 4496 wrote to memory of 2116 4496 57A1.tmp 106 PID 2116 wrote to memory of 2908 2116 587B.tmp 107 PID 2908 wrote to memory of 4604 2908 5966.tmp 108 PID 4604 wrote to memory of 2092 4604 5A6F.tmp 109 PID 2092 wrote to memory of 384 2092 5B5A.tmp 110 PID 384 wrote to memory of 1968 384 5C44.tmp 111 PID 1968 wrote to memory of 2300 1968 5D3E.tmp 112 PID 2300 wrote to memory of 2920 2300 5E38.tmp 113 PID 2920 wrote to memory of 3796 2920 5F13.tmp 114 PID 3796 wrote to memory of 3948 3796 5FFD.tmp 115 PID 3948 wrote to memory of 4884 3948 60E8.tmp 116 PID 4884 wrote to memory of 3860 4884 61F1.tmp 117 PID 3860 wrote to memory of 1180 3860 62EB.tmp 118 PID 1180 wrote to memory of 2848 1180 63B6.tmp 119 PID 2848 wrote to memory of 312 2848 64A1.tmp 120 PID 312 wrote to memory of 3296 312 653D.tmp 121 PID 3296 wrote to memory of 2972 3296 65CA.tmp 122 PID 2972 wrote to memory of 880 2972 6675.tmp 123 PID 880 wrote to memory of 3668 880 6702.tmp 124 PID 3668 wrote to memory of 2056 3668 679E.tmp 125 PID 2056 wrote to memory of 4684 2056 681B.tmp 126 PID 4684 wrote to memory of 2224 4684 68B8.tmp 127 PID 2224 wrote to memory of 4860 2224 6954.tmp 128 PID 4860 wrote to memory of 2804 4860 69D1.tmp 129 PID 2804 wrote to memory of 4208 2804 6A5D.tmp 130 PID 4208 wrote to memory of 4920 4208 6AFA.tmp 131 PID 4920 wrote to memory of 3432 4920 6B96.tmp 132 PID 3432 wrote to memory of 3840 3432 6C13.tmp 133 PID 3840 wrote to memory of 2252 3840 6CAF.tmp 134 PID 2252 wrote to memory of 3752 2252 6D3C.tmp 135 PID 3752 wrote to memory of 2084 3752 6D9A.tmp 136 PID 2084 wrote to memory of 4152 2084 6DE8.tmp 137 PID 4152 wrote to memory of 2608 4152 6E36.tmp 138 PID 2608 wrote to memory of 2040 2608 6E84.tmp 139 PID 2040 wrote to memory of 4252 2040 6ED2.tmp 140 PID 4252 wrote to memory of 4580 4252 6F20.tmp 141 PID 4580 wrote to memory of 620 4580 6F6E.tmp 142 PID 620 wrote to memory of 4544 620 6FBC.tmp 143 PID 4544 wrote to memory of 2772 4544 700B.tmp 144 PID 2772 wrote to memory of 2520 2772 7059.tmp 145 PID 2520 wrote to memory of 3652 2520 70B6.tmp 146 PID 3652 wrote to memory of 3484 3652 7105.tmp 147 PID 3484 wrote to memory of 4716 3484 7153.tmp 148 PID 4716 wrote to memory of 5020 4716 71A1.tmp 149 PID 5020 wrote to memory of 1520 5020 71EF.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_000591b70e4af6a3af1719ecda4c9971_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_000591b70e4af6a3af1719ecda4c9971_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\4496.tmp"C:\Users\Admin\AppData\Local\Temp\4496.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\4590.tmp"C:\Users\Admin\AppData\Local\Temp\4590.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\46B8.tmp"C:\Users\Admin\AppData\Local\Temp\46B8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\47F1.tmp"C:\Users\Admin\AppData\Local\Temp\47F1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\48FB.tmp"C:\Users\Admin\AppData\Local\Temp\48FB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\4A14.tmp"C:\Users\Admin\AppData\Local\Temp\4A14.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\4AFE.tmp"C:\Users\Admin\AppData\Local\Temp\4AFE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"C:\Users\Admin\AppData\Local\Temp\4CE3.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"C:\Users\Admin\AppData\Local\Temp\4EE6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"C:\Users\Admin\AppData\Local\Temp\4FF0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\50DA.tmp"C:\Users\Admin\AppData\Local\Temp\50DA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\51C5.tmp"C:\Users\Admin\AppData\Local\Temp\51C5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\52AF.tmp"C:\Users\Admin\AppData\Local\Temp\52AF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\5484.tmp"C:\Users\Admin\AppData\Local\Temp\5484.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\558D.tmp"C:\Users\Admin\AppData\Local\Temp\558D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\5687.tmp"C:\Users\Admin\AppData\Local\Temp\5687.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\57A1.tmp"C:\Users\Admin\AppData\Local\Temp\57A1.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\587B.tmp"C:\Users\Admin\AppData\Local\Temp\587B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\5C44.tmp"C:\Users\Admin\AppData\Local\Temp\5C44.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\5D3E.tmp"C:\Users\Admin\AppData\Local\Temp\5D3E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\5E38.tmp"C:\Users\Admin\AppData\Local\Temp\5E38.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\5F13.tmp"C:\Users\Admin\AppData\Local\Temp\5F13.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\5FFD.tmp"C:\Users\Admin\AppData\Local\Temp\5FFD.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\60E8.tmp"C:\Users\Admin\AppData\Local\Temp\60E8.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\61F1.tmp"C:\Users\Admin\AppData\Local\Temp\61F1.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\62EB.tmp"C:\Users\Admin\AppData\Local\Temp\62EB.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\63B6.tmp"C:\Users\Admin\AppData\Local\Temp\63B6.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\64A1.tmp"C:\Users\Admin\AppData\Local\Temp\64A1.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\653D.tmp"C:\Users\Admin\AppData\Local\Temp\653D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\65CA.tmp"C:\Users\Admin\AppData\Local\Temp\65CA.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\6675.tmp"C:\Users\Admin\AppData\Local\Temp\6675.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\6702.tmp"C:\Users\Admin\AppData\Local\Temp\6702.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\679E.tmp"C:\Users\Admin\AppData\Local\Temp\679E.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\681B.tmp"C:\Users\Admin\AppData\Local\Temp\681B.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\68B8.tmp"C:\Users\Admin\AppData\Local\Temp\68B8.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\6954.tmp"C:\Users\Admin\AppData\Local\Temp\6954.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\69D1.tmp"C:\Users\Admin\AppData\Local\Temp\69D1.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\6AFA.tmp"C:\Users\Admin\AppData\Local\Temp\6AFA.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\6B96.tmp"C:\Users\Admin\AppData\Local\Temp\6B96.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\6C13.tmp"C:\Users\Admin\AppData\Local\Temp\6C13.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\6D9A.tmp"C:\Users\Admin\AppData\Local\Temp\6D9A.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\6DE8.tmp"C:\Users\Admin\AppData\Local\Temp\6DE8.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\6E36.tmp"C:\Users\Admin\AppData\Local\Temp\6E36.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\6E84.tmp"C:\Users\Admin\AppData\Local\Temp\6E84.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\6ED2.tmp"C:\Users\Admin\AppData\Local\Temp\6ED2.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\6F20.tmp"C:\Users\Admin\AppData\Local\Temp\6F20.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\6F6E.tmp"C:\Users\Admin\AppData\Local\Temp\6F6E.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\6FBC.tmp"C:\Users\Admin\AppData\Local\Temp\6FBC.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\700B.tmp"C:\Users\Admin\AppData\Local\Temp\700B.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\7059.tmp"C:\Users\Admin\AppData\Local\Temp\7059.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\70B6.tmp"C:\Users\Admin\AppData\Local\Temp\70B6.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\7105.tmp"C:\Users\Admin\AppData\Local\Temp\7105.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\7153.tmp"C:\Users\Admin\AppData\Local\Temp\7153.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\71A1.tmp"C:\Users\Admin\AppData\Local\Temp\71A1.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\71EF.tmp"C:\Users\Admin\AppData\Local\Temp\71EF.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\723D.tmp"C:\Users\Admin\AppData\Local\Temp\723D.tmp"65⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\728B.tmp"C:\Users\Admin\AppData\Local\Temp\728B.tmp"66⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\72D9.tmp"C:\Users\Admin\AppData\Local\Temp\72D9.tmp"67⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\7327.tmp"C:\Users\Admin\AppData\Local\Temp\7327.tmp"68⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\7376.tmp"C:\Users\Admin\AppData\Local\Temp\7376.tmp"69⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\73C4.tmp"C:\Users\Admin\AppData\Local\Temp\73C4.tmp"70⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\7412.tmp"C:\Users\Admin\AppData\Local\Temp\7412.tmp"71⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\7460.tmp"C:\Users\Admin\AppData\Local\Temp\7460.tmp"72⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\74BE.tmp"C:\Users\Admin\AppData\Local\Temp\74BE.tmp"73⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\750C.tmp"C:\Users\Admin\AppData\Local\Temp\750C.tmp"74⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\755A.tmp"C:\Users\Admin\AppData\Local\Temp\755A.tmp"75⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\75B8.tmp"C:\Users\Admin\AppData\Local\Temp\75B8.tmp"76⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\7606.tmp"C:\Users\Admin\AppData\Local\Temp\7606.tmp"77⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\7654.tmp"C:\Users\Admin\AppData\Local\Temp\7654.tmp"78⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\76A2.tmp"C:\Users\Admin\AppData\Local\Temp\76A2.tmp"79⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\7700.tmp"C:\Users\Admin\AppData\Local\Temp\7700.tmp"80⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\774E.tmp"C:\Users\Admin\AppData\Local\Temp\774E.tmp"81⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\77AC.tmp"C:\Users\Admin\AppData\Local\Temp\77AC.tmp"82⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\77FA.tmp"C:\Users\Admin\AppData\Local\Temp\77FA.tmp"83⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\7848.tmp"C:\Users\Admin\AppData\Local\Temp\7848.tmp"84⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\7896.tmp"C:\Users\Admin\AppData\Local\Temp\7896.tmp"85⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\78E4.tmp"C:\Users\Admin\AppData\Local\Temp\78E4.tmp"86⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\7932.tmp"C:\Users\Admin\AppData\Local\Temp\7932.tmp"87⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\7980.tmp"C:\Users\Admin\AppData\Local\Temp\7980.tmp"88⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\79DE.tmp"C:\Users\Admin\AppData\Local\Temp\79DE.tmp"89⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"90⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\7A7A.tmp"C:\Users\Admin\AppData\Local\Temp\7A7A.tmp"91⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\7AC9.tmp"C:\Users\Admin\AppData\Local\Temp\7AC9.tmp"92⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\7B17.tmp"C:\Users\Admin\AppData\Local\Temp\7B17.tmp"93⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\7B65.tmp"C:\Users\Admin\AppData\Local\Temp\7B65.tmp"94⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"95⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\7C11.tmp"C:\Users\Admin\AppData\Local\Temp\7C11.tmp"96⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\7C5F.tmp"C:\Users\Admin\AppData\Local\Temp\7C5F.tmp"97⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\7CAD.tmp"C:\Users\Admin\AppData\Local\Temp\7CAD.tmp"98⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\7CFB.tmp"C:\Users\Admin\AppData\Local\Temp\7CFB.tmp"99⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\7D49.tmp"C:\Users\Admin\AppData\Local\Temp\7D49.tmp"100⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\7D97.tmp"C:\Users\Admin\AppData\Local\Temp\7D97.tmp"101⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"102⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\7E34.tmp"C:\Users\Admin\AppData\Local\Temp\7E34.tmp"103⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\7E82.tmp"C:\Users\Admin\AppData\Local\Temp\7E82.tmp"104⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"105⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"106⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\7F8B.tmp"C:\Users\Admin\AppData\Local\Temp\7F8B.tmp"107⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\7FD9.tmp"C:\Users\Admin\AppData\Local\Temp\7FD9.tmp"108⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\8028.tmp"C:\Users\Admin\AppData\Local\Temp\8028.tmp"109⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\8076.tmp"C:\Users\Admin\AppData\Local\Temp\8076.tmp"110⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\80C4.tmp"C:\Users\Admin\AppData\Local\Temp\80C4.tmp"111⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"112⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\8160.tmp"C:\Users\Admin\AppData\Local\Temp\8160.tmp"113⤵PID:204
-
C:\Users\Admin\AppData\Local\Temp\81BE.tmp"C:\Users\Admin\AppData\Local\Temp\81BE.tmp"114⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\820C.tmp"C:\Users\Admin\AppData\Local\Temp\820C.tmp"115⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\825A.tmp"C:\Users\Admin\AppData\Local\Temp\825A.tmp"116⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\82A8.tmp"C:\Users\Admin\AppData\Local\Temp\82A8.tmp"117⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\82F6.tmp"C:\Users\Admin\AppData\Local\Temp\82F6.tmp"118⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\8344.tmp"C:\Users\Admin\AppData\Local\Temp\8344.tmp"119⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\83A2.tmp"C:\Users\Admin\AppData\Local\Temp\83A2.tmp"120⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\83F0.tmp"C:\Users\Admin\AppData\Local\Temp\83F0.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\843E.tmp"C:\Users\Admin\AppData\Local\Temp\843E.tmp"122⤵PID:1000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-