Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 15:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_563553609d3ca3d84e7a315af3415a9f_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_563553609d3ca3d84e7a315af3415a9f_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-04_563553609d3ca3d84e7a315af3415a9f_elex_mafia_stealc_tofsee.exe
- Size 541KB
- Sample260804-s6pnystemb
- SHA256 5ae289b6e47e8168265a2691666db08b0d0f8564f8733b3ded392cc2e7fe388d
- MD5 563553609d3ca3d84e7a315af3415a9f
- SHA1 9ebd2e3bca598a96d7d0b61d158d47cdd19351c9
- SHA512 dcc27514796faccfb2c0cccc11f60cd1803f8120b5dde9dd2e8600ef0b7aa30e983602cc481300d540319b64441121e419d4012ddf43aa38a3624b52fb282859
- SSDEEP 12288:HU5rCOTeiJAH4ASReI0IyvMmZ0ahbic8iNZb73ctO:HUQOJJydSoRIm/qiNV73ctO
- TLSH T11FC4E0227585C232E6D202710BD6EBE23E3ABC71532295C73B94623E1BB67E1D375346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 648 8393.tmp 4388 843E.tmp 4040 84DB.tmp 1372 8558.tmp 1040 85B5.tmp 4364 8613.tmp 3204 8681.tmp 3396 86CF.tmp 3892 871D.tmp 3420 877B.tmp 1780 87E8.tmp 2280 8836.tmp 1936 8894.tmp 4124 88F2.tmp 4552 8940.tmp 2392 899D.tmp 4452 89EC.tmp 1220 8A3A.tmp 4884 8A88.tmp 432 8AE6.tmp 2208 8B43.tmp 1216 8BA1.tmp 2172 8BEF.tmp 4548 8C3D.tmp 4992 8C8B.tmp 3012 8CDA.tmp 1668 8D28.tmp 3688 8D85.tmp 4536 8DD4.tmp 3256 8E51.tmp 1788 8EAE.tmp 3324 8F0C.tmp 4944 8F5A.tmp 4476 8FA8.tmp 4872 8FE7.tmp 2516 9035.tmp 4560 9083.tmp 3852 90D1.tmp 4060 911F.tmp 2872 916D.tmp 4696 91BC.tmp 2396 920A.tmp 3376 9258.tmp 2592 92A6.tmp 4924 92F4.tmp 3936 9342.tmp 1228 9390.tmp 908 93DE.tmp 4568 942D.tmp 640 947B.tmp 3788 94C9.tmp 1712 9517.tmp 3424 9565.tmp 4400 95D2.tmp 1704 9621.tmp 4228 96BD.tmp 4524 970B.tmp 5064 9759.tmp 1564 97A7.tmp 2832 97F5.tmp 5048 9843.tmp 4184 9892.tmp 5000 98E0.tmp 4484 992E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A709.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3435.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 877B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 287D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4404.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E40D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F67C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 528B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9040.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 197.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2800 wrote to memory of 648 2800 2026-08-04_563553609d3ca3d84e7a315af3415a9f_elex_mafia_stealc_tofsee.exe 82 PID 648 wrote to memory of 4388 648 8393.tmp 83 PID 4388 wrote to memory of 4040 4388 843E.tmp 84 PID 4040 wrote to memory of 1372 4040 84DB.tmp 85 PID 1372 wrote to memory of 1040 1372 8558.tmp 86 PID 1040 wrote to memory of 4364 1040 85B5.tmp 87 PID 4364 wrote to memory of 3204 4364 8613.tmp 88 PID 3204 wrote to memory of 3396 3204 8681.tmp 89 PID 3396 wrote to memory of 3892 3396 86CF.tmp 90 PID 3892 wrote to memory of 3420 3892 871D.tmp 91 PID 3420 wrote to memory of 1780 3420 877B.tmp 92 PID 1780 wrote to memory of 2280 1780 87E8.tmp 93 PID 2280 wrote to memory of 1936 2280 8836.tmp 94 PID 1936 wrote to memory of 4124 1936 8894.tmp 95 PID 4124 wrote to memory of 4552 4124 88F2.tmp 96 PID 4552 wrote to memory of 2392 4552 8940.tmp 97 PID 2392 wrote to memory of 4452 2392 899D.tmp 98 PID 4452 wrote to memory of 1220 4452 89EC.tmp 99 PID 1220 wrote to memory of 4884 1220 8A3A.tmp 100 PID 4884 wrote to memory of 432 4884 8A88.tmp 101 PID 432 wrote to memory of 2208 432 8AE6.tmp 102 PID 2208 wrote to memory of 1216 2208 8B43.tmp 103 PID 1216 wrote to memory of 2172 1216 8BA1.tmp 104 PID 2172 wrote to memory of 4548 2172 8BEF.tmp 105 PID 4548 wrote to memory of 4992 4548 8C3D.tmp 106 PID 4992 wrote to memory of 3012 4992 8C8B.tmp 107 PID 3012 wrote to memory of 1668 3012 8CDA.tmp 108 PID 1668 wrote to memory of 3688 1668 8D28.tmp 109 PID 3688 wrote to memory of 4536 3688 8D85.tmp 110 PID 4536 wrote to memory of 3256 4536 8DD4.tmp 111 PID 3256 wrote to memory of 1788 3256 8E51.tmp 113 PID 1788 wrote to memory of 3324 1788 8EAE.tmp 114 PID 3324 wrote to memory of 4944 3324 8F0C.tmp 115 PID 4944 wrote to memory of 4476 4944 8F5A.tmp 116 PID 4476 wrote to memory of 4872 4476 8FA8.tmp 117 PID 4872 wrote to memory of 2516 4872 8FE7.tmp 118 PID 2516 wrote to memory of 4560 2516 9035.tmp 119 PID 4560 wrote to memory of 3852 4560 9083.tmp 120 PID 3852 wrote to memory of 4060 3852 90D1.tmp 121 PID 4060 wrote to memory of 2872 4060 911F.tmp 122 PID 2872 wrote to memory of 4696 2872 916D.tmp 123 PID 4696 wrote to memory of 2396 4696 91BC.tmp 124 PID 2396 wrote to memory of 3376 2396 920A.tmp 125 PID 3376 wrote to memory of 2592 3376 9258.tmp 126 PID 2592 wrote to memory of 4924 2592 92A6.tmp 127 PID 4924 wrote to memory of 3936 4924 92F4.tmp 128 PID 3936 wrote to memory of 1228 3936 9342.tmp 129 PID 1228 wrote to memory of 908 1228 9390.tmp 130 PID 908 wrote to memory of 4568 908 93DE.tmp 131 PID 4568 wrote to memory of 640 4568 942D.tmp 132 PID 640 wrote to memory of 3788 640 947B.tmp 133 PID 3788 wrote to memory of 1712 3788 94C9.tmp 134 PID 1712 wrote to memory of 3424 1712 9517.tmp 135 PID 3424 wrote to memory of 4400 3424 9565.tmp 136 PID 4400 wrote to memory of 1704 4400 95D2.tmp 137 PID 3440 wrote to memory of 4228 3440 966F.tmp 139 PID 4228 wrote to memory of 4524 4228 96BD.tmp 140 PID 4524 wrote to memory of 5064 4524 970B.tmp 141 PID 5064 wrote to memory of 1564 5064 9759.tmp 142 PID 1564 wrote to memory of 2832 1564 97A7.tmp 143 PID 2832 wrote to memory of 5048 2832 97F5.tmp 144 PID 5048 wrote to memory of 4184 5048 9843.tmp 145 PID 4184 wrote to memory of 5000 4184 9892.tmp 146 PID 5000 wrote to memory of 4484 5000 98E0.tmp 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_563553609d3ca3d84e7a315af3415a9f_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_563553609d3ca3d84e7a315af3415a9f_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\8393.tmp"C:\Users\Admin\AppData\Local\Temp\8393.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\843E.tmp"C:\Users\Admin\AppData\Local\Temp\843E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\84DB.tmp"C:\Users\Admin\AppData\Local\Temp\84DB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\8558.tmp"C:\Users\Admin\AppData\Local\Temp\8558.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\85B5.tmp"C:\Users\Admin\AppData\Local\Temp\85B5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\8613.tmp"C:\Users\Admin\AppData\Local\Temp\8613.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\8681.tmp"C:\Users\Admin\AppData\Local\Temp\8681.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\86CF.tmp"C:\Users\Admin\AppData\Local\Temp\86CF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\871D.tmp"C:\Users\Admin\AppData\Local\Temp\871D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\877B.tmp"C:\Users\Admin\AppData\Local\Temp\877B.tmp"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\87E8.tmp"C:\Users\Admin\AppData\Local\Temp\87E8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\8836.tmp"C:\Users\Admin\AppData\Local\Temp\8836.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\8894.tmp"C:\Users\Admin\AppData\Local\Temp\8894.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\88F2.tmp"C:\Users\Admin\AppData\Local\Temp\88F2.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\8940.tmp"C:\Users\Admin\AppData\Local\Temp\8940.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\899D.tmp"C:\Users\Admin\AppData\Local\Temp\899D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\89EC.tmp"C:\Users\Admin\AppData\Local\Temp\89EC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\8A3A.tmp"C:\Users\Admin\AppData\Local\Temp\8A3A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\8A88.tmp"C:\Users\Admin\AppData\Local\Temp\8A88.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\8AE6.tmp"C:\Users\Admin\AppData\Local\Temp\8AE6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\8B43.tmp"C:\Users\Admin\AppData\Local\Temp\8B43.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\8BA1.tmp"C:\Users\Admin\AppData\Local\Temp\8BA1.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"C:\Users\Admin\AppData\Local\Temp\8C3D.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\8C8B.tmp"C:\Users\Admin\AppData\Local\Temp\8C8B.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\8CDA.tmp"C:\Users\Admin\AppData\Local\Temp\8CDA.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\8D28.tmp"C:\Users\Admin\AppData\Local\Temp\8D28.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\8D85.tmp"C:\Users\Admin\AppData\Local\Temp\8D85.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\8DD4.tmp"C:\Users\Admin\AppData\Local\Temp\8DD4.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\8E51.tmp"C:\Users\Admin\AppData\Local\Temp\8E51.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"C:\Users\Admin\AppData\Local\Temp\8F0C.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\8FE7.tmp"C:\Users\Admin\AppData\Local\Temp\8FE7.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\9035.tmp"C:\Users\Admin\AppData\Local\Temp\9035.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\9083.tmp"C:\Users\Admin\AppData\Local\Temp\9083.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\90D1.tmp"C:\Users\Admin\AppData\Local\Temp\90D1.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\911F.tmp"C:\Users\Admin\AppData\Local\Temp\911F.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\916D.tmp"C:\Users\Admin\AppData\Local\Temp\916D.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\91BC.tmp"C:\Users\Admin\AppData\Local\Temp\91BC.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\920A.tmp"C:\Users\Admin\AppData\Local\Temp\920A.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\9258.tmp"C:\Users\Admin\AppData\Local\Temp\9258.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\92A6.tmp"C:\Users\Admin\AppData\Local\Temp\92A6.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\92F4.tmp"C:\Users\Admin\AppData\Local\Temp\92F4.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\9342.tmp"C:\Users\Admin\AppData\Local\Temp\9342.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\9390.tmp"C:\Users\Admin\AppData\Local\Temp\9390.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\93DE.tmp"C:\Users\Admin\AppData\Local\Temp\93DE.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\942D.tmp"C:\Users\Admin\AppData\Local\Temp\942D.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\947B.tmp"C:\Users\Admin\AppData\Local\Temp\947B.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\94C9.tmp"C:\Users\Admin\AppData\Local\Temp\94C9.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\9517.tmp"C:\Users\Admin\AppData\Local\Temp\9517.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\9565.tmp"C:\Users\Admin\AppData\Local\Temp\9565.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\95D2.tmp"C:\Users\Admin\AppData\Local\Temp\95D2.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\9621.tmp"C:\Users\Admin\AppData\Local\Temp\9621.tmp"56⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\966F.tmp"C:\Users\Admin\AppData\Local\Temp\966F.tmp"57⤵
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\96BD.tmp"C:\Users\Admin\AppData\Local\Temp\96BD.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\970B.tmp"C:\Users\Admin\AppData\Local\Temp\970B.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\9759.tmp"C:\Users\Admin\AppData\Local\Temp\9759.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\97A7.tmp"C:\Users\Admin\AppData\Local\Temp\97A7.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\97F5.tmp"C:\Users\Admin\AppData\Local\Temp\97F5.tmp"62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\9843.tmp"C:\Users\Admin\AppData\Local\Temp\9843.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\9892.tmp"C:\Users\Admin\AppData\Local\Temp\9892.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\98E0.tmp"C:\Users\Admin\AppData\Local\Temp\98E0.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\992E.tmp"C:\Users\Admin\AppData\Local\Temp\992E.tmp"66⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\997C.tmp"C:\Users\Admin\AppData\Local\Temp\997C.tmp"67⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\99CA.tmp"C:\Users\Admin\AppData\Local\Temp\99CA.tmp"68⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\9A18.tmp"C:\Users\Admin\AppData\Local\Temp\9A18.tmp"69⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\9A66.tmp"C:\Users\Admin\AppData\Local\Temp\9A66.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\9AB4.tmp"C:\Users\Admin\AppData\Local\Temp\9AB4.tmp"71⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\9B03.tmp"C:\Users\Admin\AppData\Local\Temp\9B03.tmp"72⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\9B51.tmp"C:\Users\Admin\AppData\Local\Temp\9B51.tmp"73⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\9B9F.tmp"C:\Users\Admin\AppData\Local\Temp\9B9F.tmp"74⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\9BED.tmp"C:\Users\Admin\AppData\Local\Temp\9BED.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\9C3B.tmp"C:\Users\Admin\AppData\Local\Temp\9C3B.tmp"76⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\9C89.tmp"C:\Users\Admin\AppData\Local\Temp\9C89.tmp"77⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\9CD7.tmp"C:\Users\Admin\AppData\Local\Temp\9CD7.tmp"78⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\9D25.tmp"C:\Users\Admin\AppData\Local\Temp\9D25.tmp"79⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\9D74.tmp"C:\Users\Admin\AppData\Local\Temp\9D74.tmp"80⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\9DC2.tmp"C:\Users\Admin\AppData\Local\Temp\9DC2.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\9E10.tmp"C:\Users\Admin\AppData\Local\Temp\9E10.tmp"82⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\9E5E.tmp"C:\Users\Admin\AppData\Local\Temp\9E5E.tmp"83⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\9EAC.tmp"C:\Users\Admin\AppData\Local\Temp\9EAC.tmp"84⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\9EFA.tmp"C:\Users\Admin\AppData\Local\Temp\9EFA.tmp"85⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\9F48.tmp"C:\Users\Admin\AppData\Local\Temp\9F48.tmp"86⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\9F96.tmp"C:\Users\Admin\AppData\Local\Temp\9F96.tmp"87⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\9FE5.tmp"C:\Users\Admin\AppData\Local\Temp\9FE5.tmp"88⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\A033.tmp"C:\Users\Admin\AppData\Local\Temp\A033.tmp"89⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\A081.tmp"C:\Users\Admin\AppData\Local\Temp\A081.tmp"90⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\A0CF.tmp"C:\Users\Admin\AppData\Local\Temp\A0CF.tmp"91⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\A11D.tmp"C:\Users\Admin\AppData\Local\Temp\A11D.tmp"92⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\A17B.tmp"C:\Users\Admin\AppData\Local\Temp\A17B.tmp"93⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\A1C9.tmp"C:\Users\Admin\AppData\Local\Temp\A1C9.tmp"94⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\A217.tmp"C:\Users\Admin\AppData\Local\Temp\A217.tmp"95⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\A265.tmp"C:\Users\Admin\AppData\Local\Temp\A265.tmp"96⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\A2B3.tmp"C:\Users\Admin\AppData\Local\Temp\A2B3.tmp"97⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\A301.tmp"C:\Users\Admin\AppData\Local\Temp\A301.tmp"98⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\A350.tmp"C:\Users\Admin\AppData\Local\Temp\A350.tmp"99⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\A39E.tmp"C:\Users\Admin\AppData\Local\Temp\A39E.tmp"100⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"101⤵PID:4148
-
C:\Users\Admin\AppData\Local\Temp\A43A.tmp"C:\Users\Admin\AppData\Local\Temp\A43A.tmp"102⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\A498.tmp"C:\Users\Admin\AppData\Local\Temp\A498.tmp"103⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\A4E6.tmp"C:\Users\Admin\AppData\Local\Temp\A4E6.tmp"104⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\A534.tmp"C:\Users\Admin\AppData\Local\Temp\A534.tmp"105⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\A582.tmp"C:\Users\Admin\AppData\Local\Temp\A582.tmp"106⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\A5D0.tmp"C:\Users\Admin\AppData\Local\Temp\A5D0.tmp"107⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\A61E.tmp"C:\Users\Admin\AppData\Local\Temp\A61E.tmp"108⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\A66C.tmp"C:\Users\Admin\AppData\Local\Temp\A66C.tmp"109⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"110⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\A709.tmp"C:\Users\Admin\AppData\Local\Temp\A709.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\A757.tmp"C:\Users\Admin\AppData\Local\Temp\A757.tmp"112⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"113⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"114⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\A841.tmp"C:\Users\Admin\AppData\Local\Temp\A841.tmp"115⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\A88F.tmp"C:\Users\Admin\AppData\Local\Temp\A88F.tmp"116⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"117⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\A92C.tmp"C:\Users\Admin\AppData\Local\Temp\A92C.tmp"118⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\A989.tmp"C:\Users\Admin\AppData\Local\Temp\A989.tmp"119⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\A9E7.tmp"C:\Users\Admin\AppData\Local\Temp\A9E7.tmp"120⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\AA45.tmp"C:\Users\Admin\AppData\Local\Temp\AA45.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\AAA3.tmp"C:\Users\Admin\AppData\Local\Temp\AAA3.tmp"122⤵PID:3264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-