Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 08:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_6e0963df422124c818bf9ecec7e94679_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_6e0963df422124c818bf9ecec7e94679_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_6e0963df422124c818bf9ecec7e94679_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260802-kfas4sff85
- SHA256 e960671831984261f3e9a45afdd540dc3013fbcd6d37828330f0ad9d6e6d26e0
- MD5 6e0963df422124c818bf9ecec7e94679
- SHA1 4f9c860887929200982980c95b56bae18202c4dd
- SHA512 2335ef6e625afc0963376a17c161509c4521e380b5a5ebb2d37155cffe0e8800ef3c84052fe51001f97984c4c4b9c07634d39acfc9cb3e9c0fe931ec18ce5737
- SSDEEP 12288:9U5rCOTei6YscVuMICXQYWMGGYQBZkzMCa+qZoXWjdq:9UQOJ617MICX1dGnmkACa+qqGh
- TLSH T190C4F121B584C033E9D202354ED6EBB2697A7D31472664C77BD4A77E6FB42E1E338206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1528 5658.tmp 4860 5724.tmp 1676 57CF.tmp 2844 58BA.tmp 4568 5975.tmp 3700 5A02.tmp 2072 5A7F.tmp 924 5B0C.tmp 4480 5BA8.tmp 4976 5C54.tmp 5032 5D00.tmp 4696 5D8C.tmp 2552 5E86.tmp 4664 5F32.tmp 2784 5FEE.tmp 1264 608A.tmp 4408 6107.tmp 3388 61D2.tmp 3456 62AD.tmp 3192 6359.tmp 1404 63C6.tmp 3532 6462.tmp 4688 650E.tmp 3648 65CA.tmp 2836 6656.tmp 3384 6712.tmp 4612 67EC.tmp 1772 68A8.tmp 1380 6954.tmp 4896 69F0.tmp 3808 6A6D.tmp 768 6B19.tmp 1808 6B86.tmp 4864 6BD4.tmp 3208 6C51.tmp 2588 6CAF.tmp 4152 6D0D.tmp 3500 6D5B.tmp 1800 6DB9.tmp 3988 6E07.tmp 904 6E65.tmp 3952 6EC2.tmp 2492 6F20.tmp 4404 6F6E.tmp 4324 6FCC.tmp 4332 7039.tmp 1476 7097.tmp 4128 70F5.tmp 4352 7143.tmp 3272 7191.tmp 4728 71DF.tmp 628 723D.tmp 1964 72AA.tmp 1124 72F9.tmp 2136 7347.tmp 2500 73A4.tmp 2688 7421.tmp 984 7470.tmp 1744 74DD.tmp 2984 752B.tmp 4832 7589.tmp 1716 75D7.tmp 1844 7635.tmp 3160 7692.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B750.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D58B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D43E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8488.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CECF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 723D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8316.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7347.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8112.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 142A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C26C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4491.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 791E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8548.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D25A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B39B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 742C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7635.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C1E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3212 wrote to memory of 1528 3212 2026-08-02_6e0963df422124c818bf9ecec7e94679_elex_mafia_stealc_tofsee.exe 86 PID 1528 wrote to memory of 4860 1528 5658.tmp 87 PID 4860 wrote to memory of 1676 4860 5724.tmp 88 PID 1676 wrote to memory of 2844 1676 57CF.tmp 89 PID 2844 wrote to memory of 4568 2844 58BA.tmp 90 PID 4568 wrote to memory of 3700 4568 5975.tmp 91 PID 3700 wrote to memory of 2072 3700 5A02.tmp 92 PID 2072 wrote to memory of 924 2072 5A7F.tmp 93 PID 924 wrote to memory of 4480 924 5B0C.tmp 94 PID 4480 wrote to memory of 4976 4480 5BA8.tmp 95 PID 4976 wrote to memory of 5032 4976 5C54.tmp 96 PID 5032 wrote to memory of 4696 5032 5D00.tmp 97 PID 4696 wrote to memory of 2552 4696 5D8C.tmp 98 PID 2552 wrote to memory of 4664 2552 5E86.tmp 99 PID 4664 wrote to memory of 2784 4664 5F32.tmp 100 PID 2784 wrote to memory of 1264 2784 5FEE.tmp 101 PID 1264 wrote to memory of 4408 1264 608A.tmp 104 PID 4408 wrote to memory of 3388 4408 6107.tmp 105 PID 3388 wrote to memory of 3456 3388 61D2.tmp 106 PID 3456 wrote to memory of 3192 3456 62AD.tmp 107 PID 3192 wrote to memory of 1404 3192 6359.tmp 108 PID 1404 wrote to memory of 3532 1404 63C6.tmp 109 PID 3532 wrote to memory of 4688 3532 6462.tmp 110 PID 4688 wrote to memory of 3648 4688 650E.tmp 112 PID 3648 wrote to memory of 2836 3648 65CA.tmp 113 PID 2836 wrote to memory of 3384 2836 6656.tmp 115 PID 3384 wrote to memory of 4612 3384 6712.tmp 116 PID 4612 wrote to memory of 1772 4612 67EC.tmp 117 PID 1772 wrote to memory of 1380 1772 68A8.tmp 118 PID 1380 wrote to memory of 4896 1380 6954.tmp 119 PID 4896 wrote to memory of 3808 4896 69F0.tmp 120 PID 3808 wrote to memory of 768 3808 6A6D.tmp 121 PID 768 wrote to memory of 1808 768 6B19.tmp 122 PID 1808 wrote to memory of 4864 1808 6B86.tmp 123 PID 4864 wrote to memory of 3208 4864 6BD4.tmp 124 PID 3208 wrote to memory of 2588 3208 6C51.tmp 125 PID 2588 wrote to memory of 4152 2588 6CAF.tmp 126 PID 4152 wrote to memory of 3500 4152 6D0D.tmp 127 PID 3500 wrote to memory of 1800 3500 6D5B.tmp 128 PID 1800 wrote to memory of 3988 1800 6DB9.tmp 129 PID 3988 wrote to memory of 904 3988 6E07.tmp 130 PID 904 wrote to memory of 3952 904 6E65.tmp 131 PID 3952 wrote to memory of 2492 3952 6EC2.tmp 132 PID 2492 wrote to memory of 4404 2492 6F20.tmp 133 PID 4404 wrote to memory of 4324 4404 6F6E.tmp 134 PID 4324 wrote to memory of 4332 4324 6FCC.tmp 135 PID 4332 wrote to memory of 1476 4332 7039.tmp 136 PID 1476 wrote to memory of 4128 1476 7097.tmp 137 PID 4128 wrote to memory of 4352 4128 70F5.tmp 138 PID 4352 wrote to memory of 3272 4352 7143.tmp 140 PID 3272 wrote to memory of 4728 3272 7191.tmp 141 PID 4728 wrote to memory of 628 4728 71DF.tmp 142 PID 628 wrote to memory of 1964 628 723D.tmp 143 PID 1964 wrote to memory of 1124 1964 72AA.tmp 144 PID 1124 wrote to memory of 2136 1124 72F9.tmp 145 PID 2136 wrote to memory of 2500 2136 7347.tmp 146 PID 2500 wrote to memory of 2688 2500 73A4.tmp 147 PID 2688 wrote to memory of 984 2688 7421.tmp 148 PID 984 wrote to memory of 1744 984 7470.tmp 149 PID 1744 wrote to memory of 2984 1744 74DD.tmp 150 PID 2984 wrote to memory of 4832 2984 752B.tmp 151 PID 4832 wrote to memory of 1716 4832 7589.tmp 152 PID 1716 wrote to memory of 1844 1716 75D7.tmp 153 PID 1844 wrote to memory of 3160 1844 7635.tmp 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_6e0963df422124c818bf9ecec7e94679_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_6e0963df422124c818bf9ecec7e94679_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\5658.tmp"C:\Users\Admin\AppData\Local\Temp\5658.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\5724.tmp"C:\Users\Admin\AppData\Local\Temp\5724.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\57CF.tmp"C:\Users\Admin\AppData\Local\Temp\57CF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\5975.tmp"C:\Users\Admin\AppData\Local\Temp\5975.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"C:\Users\Admin\AppData\Local\Temp\5B0C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\5BA8.tmp"C:\Users\Admin\AppData\Local\Temp\5BA8.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\5C54.tmp"C:\Users\Admin\AppData\Local\Temp\5C54.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\5D00.tmp"C:\Users\Admin\AppData\Local\Temp\5D00.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\5D8C.tmp"C:\Users\Admin\AppData\Local\Temp\5D8C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\5E86.tmp"C:\Users\Admin\AppData\Local\Temp\5E86.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\5F32.tmp"C:\Users\Admin\AppData\Local\Temp\5F32.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\5FEE.tmp"C:\Users\Admin\AppData\Local\Temp\5FEE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\608A.tmp"C:\Users\Admin\AppData\Local\Temp\608A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\6107.tmp"C:\Users\Admin\AppData\Local\Temp\6107.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\61D2.tmp"C:\Users\Admin\AppData\Local\Temp\61D2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\62AD.tmp"C:\Users\Admin\AppData\Local\Temp\62AD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\6359.tmp"C:\Users\Admin\AppData\Local\Temp\6359.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\63C6.tmp"C:\Users\Admin\AppData\Local\Temp\63C6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\6462.tmp"C:\Users\Admin\AppData\Local\Temp\6462.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\650E.tmp"C:\Users\Admin\AppData\Local\Temp\650E.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\65CA.tmp"C:\Users\Admin\AppData\Local\Temp\65CA.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\6656.tmp"C:\Users\Admin\AppData\Local\Temp\6656.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\6712.tmp"C:\Users\Admin\AppData\Local\Temp\6712.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\67EC.tmp"C:\Users\Admin\AppData\Local\Temp\67EC.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\68A8.tmp"C:\Users\Admin\AppData\Local\Temp\68A8.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\6954.tmp"C:\Users\Admin\AppData\Local\Temp\6954.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\69F0.tmp"C:\Users\Admin\AppData\Local\Temp\69F0.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\6A6D.tmp"C:\Users\Admin\AppData\Local\Temp\6A6D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\6B19.tmp"C:\Users\Admin\AppData\Local\Temp\6B19.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\6B86.tmp"C:\Users\Admin\AppData\Local\Temp\6B86.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"C:\Users\Admin\AppData\Local\Temp\6BD4.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\6C51.tmp"C:\Users\Admin\AppData\Local\Temp\6C51.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"C:\Users\Admin\AppData\Local\Temp\6D5B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\6DB9.tmp"C:\Users\Admin\AppData\Local\Temp\6DB9.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\6E07.tmp"C:\Users\Admin\AppData\Local\Temp\6E07.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\6E65.tmp"C:\Users\Admin\AppData\Local\Temp\6E65.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"C:\Users\Admin\AppData\Local\Temp\6EC2.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\6F20.tmp"C:\Users\Admin\AppData\Local\Temp\6F20.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\6F6E.tmp"C:\Users\Admin\AppData\Local\Temp\6F6E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"C:\Users\Admin\AppData\Local\Temp\6FCC.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\7039.tmp"C:\Users\Admin\AppData\Local\Temp\7039.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\7097.tmp"C:\Users\Admin\AppData\Local\Temp\7097.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\70F5.tmp"C:\Users\Admin\AppData\Local\Temp\70F5.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\7143.tmp"C:\Users\Admin\AppData\Local\Temp\7143.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\7191.tmp"C:\Users\Admin\AppData\Local\Temp\7191.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\71DF.tmp"C:\Users\Admin\AppData\Local\Temp\71DF.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\723D.tmp"C:\Users\Admin\AppData\Local\Temp\723D.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\72AA.tmp"C:\Users\Admin\AppData\Local\Temp\72AA.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\72F9.tmp"C:\Users\Admin\AppData\Local\Temp\72F9.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\7347.tmp"C:\Users\Admin\AppData\Local\Temp\7347.tmp"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\73A4.tmp"C:\Users\Admin\AppData\Local\Temp\73A4.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\7421.tmp"C:\Users\Admin\AppData\Local\Temp\7421.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\7470.tmp"C:\Users\Admin\AppData\Local\Temp\7470.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\74DD.tmp"C:\Users\Admin\AppData\Local\Temp\74DD.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\752B.tmp"C:\Users\Admin\AppData\Local\Temp\752B.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\7589.tmp"C:\Users\Admin\AppData\Local\Temp\7589.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\75D7.tmp"C:\Users\Admin\AppData\Local\Temp\75D7.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\7635.tmp"C:\Users\Admin\AppData\Local\Temp\7635.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\7692.tmp"C:\Users\Admin\AppData\Local\Temp\7692.tmp"65⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\76E1.tmp"C:\Users\Admin\AppData\Local\Temp\76E1.tmp"66⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\773E.tmp"C:\Users\Admin\AppData\Local\Temp\773E.tmp"67⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\778C.tmp"C:\Users\Admin\AppData\Local\Temp\778C.tmp"68⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\77EA.tmp"C:\Users\Admin\AppData\Local\Temp\77EA.tmp"69⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\7848.tmp"C:\Users\Admin\AppData\Local\Temp\7848.tmp"70⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\7896.tmp"C:\Users\Admin\AppData\Local\Temp\7896.tmp"71⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\78E4.tmp"C:\Users\Admin\AppData\Local\Temp\78E4.tmp"72⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\7942.tmp"C:\Users\Admin\AppData\Local\Temp\7942.tmp"73⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\79A0.tmp"C:\Users\Admin\AppData\Local\Temp\79A0.tmp"74⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\7A1D.tmp"C:\Users\Admin\AppData\Local\Temp\7A1D.tmp"75⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"76⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"77⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\7B46.tmp"C:\Users\Admin\AppData\Local\Temp\7B46.tmp"78⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\7B94.tmp"C:\Users\Admin\AppData\Local\Temp\7B94.tmp"79⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\7BE2.tmp"C:\Users\Admin\AppData\Local\Temp\7BE2.tmp"80⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\7C40.tmp"C:\Users\Admin\AppData\Local\Temp\7C40.tmp"81⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"82⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\7CFB.tmp"C:\Users\Admin\AppData\Local\Temp\7CFB.tmp"83⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\7D49.tmp"C:\Users\Admin\AppData\Local\Temp\7D49.tmp"84⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\7D97.tmp"C:\Users\Admin\AppData\Local\Temp\7D97.tmp"85⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"86⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\7E34.tmp"C:\Users\Admin\AppData\Local\Temp\7E34.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"88⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\7EEF.tmp"C:\Users\Admin\AppData\Local\Temp\7EEF.tmp"89⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"90⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"91⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"92⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\8056.tmp"C:\Users\Admin\AppData\Local\Temp\8056.tmp"93⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\80C4.tmp"C:\Users\Admin\AppData\Local\Temp\80C4.tmp"94⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\8170.tmp"C:\Users\Admin\AppData\Local\Temp\8170.tmp"96⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\81BE.tmp"C:\Users\Admin\AppData\Local\Temp\81BE.tmp"97⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\823B.tmp"C:\Users\Admin\AppData\Local\Temp\823B.tmp"98⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\82A8.tmp"C:\Users\Admin\AppData\Local\Temp\82A8.tmp"99⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\8316.tmp"C:\Users\Admin\AppData\Local\Temp\8316.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\8364.tmp"C:\Users\Admin\AppData\Local\Temp\8364.tmp"101⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\83C1.tmp"C:\Users\Admin\AppData\Local\Temp\83C1.tmp"102⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\8410.tmp"C:\Users\Admin\AppData\Local\Temp\8410.tmp"103⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\846D.tmp"C:\Users\Admin\AppData\Local\Temp\846D.tmp"104⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\84DB.tmp"C:\Users\Admin\AppData\Local\Temp\84DB.tmp"105⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\8548.tmp"C:\Users\Admin\AppData\Local\Temp\8548.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\8596.tmp"C:\Users\Admin\AppData\Local\Temp\8596.tmp"107⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\85E4.tmp"C:\Users\Admin\AppData\Local\Temp\85E4.tmp"108⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\8642.tmp"C:\Users\Admin\AppData\Local\Temp\8642.tmp"109⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\86BF.tmp"C:\Users\Admin\AppData\Local\Temp\86BF.tmp"110⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\870D.tmp"C:\Users\Admin\AppData\Local\Temp\870D.tmp"111⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\876B.tmp"C:\Users\Admin\AppData\Local\Temp\876B.tmp"112⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\87B9.tmp"C:\Users\Admin\AppData\Local\Temp\87B9.tmp"113⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\8807.tmp"C:\Users\Admin\AppData\Local\Temp\8807.tmp"114⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\8865.tmp"C:\Users\Admin\AppData\Local\Temp\8865.tmp"115⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\88B3.tmp"C:\Users\Admin\AppData\Local\Temp\88B3.tmp"116⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\8911.tmp"C:\Users\Admin\AppData\Local\Temp\8911.tmp"117⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\896F.tmp"C:\Users\Admin\AppData\Local\Temp\896F.tmp"118⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\89BD.tmp"C:\Users\Admin\AppData\Local\Temp\89BD.tmp"119⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\8A2A.tmp"C:\Users\Admin\AppData\Local\Temp\8A2A.tmp"120⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\8A78.tmp"C:\Users\Admin\AppData\Local\Temp\8A78.tmp"121⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"122⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-