Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/08/2026, 00:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_6e377be08270d4a7e9221af8c624350b_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_6e377be08270d4a7e9221af8c624350b_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-05_6e377be08270d4a7e9221af8c624350b_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260806-ah2phaam2w
- SHA256 0cf5ca2ce60d1635c75b30e32958a10bb9df26a1897ab06348f81e58d0a116a1
- MD5 6e377be08270d4a7e9221af8c624350b
- SHA1 ba9280496d620910774c5dbf9af8f981a2fac35d
- SHA512 f327c8288757b8807a1a471d0c6f36f59f8e79fad49c173727b391a3565e8e90d89c04a12865a73c16e0eea2dd6ce03947b7dfc6b201af3a5eb655c57d639305
- SSDEEP 12288:9U5rCOTei6PMpVC46no8t8Tz9g6CjSppSqZoXWjdq:9UQOJ6P+C46nAzSGppSqqGh
- TLSH T148C40121B689C432E6A202304EE6EB71697A7C715B26A0C777C0776E6FB52E1D774303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4752 4F54.tmp 2436 502E.tmp 4704 50EA.tmp 5032 51E4.tmp 4360 529F.tmp 1240 534B.tmp 3264 5416.tmp 1316 54A3.tmp 4872 554F.tmp 1272 561A.tmp 4748 56E5.tmp 3816 5791.tmp 2080 580E.tmp 1280 58D9.tmp 3820 59A4.tmp 2180 5A21.tmp 3356 5ADD.tmp 3548 5B98.tmp 3256 5C63.tmp 2092 5CF0.tmp 4684 5D5D.tmp 4496 5DEA.tmp 4532 5E86.tmp 3188 5F42.tmp 4820 5FDE.tmp 1484 607A.tmp 2100 6136.tmp 4084 61B3.tmp 3468 624F.tmp 4624 62CC.tmp 3216 6349.tmp 3472 6424.tmp 2896 6491.tmp 468 64FE.tmp 3016 656C.tmp 4916 65BA.tmp 3900 6608.tmp 3628 6656.tmp 1748 66B4.tmp 1696 6702.tmp 2724 6750.tmp 1848 679E.tmp 1600 67EC.tmp 4080 683B.tmp 1064 6889.tmp 3120 68D7.tmp 720 6925.tmp 1892 6973.tmp 512 69D1.tmp 2172 6A2F.tmp 3852 6A7D.tmp 2604 6ADA.tmp 1956 6B29.tmp 3380 6BC5.tmp 2884 6C13.tmp 1644 6C71.tmp 2400 6CDE.tmp 3872 6D4B.tmp 4412 6DA9.tmp 2028 6DF7.tmp 3796 6E45.tmp 676 6E94.tmp 4612 6EF1.tmp 3692 6F3F.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B169.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C772.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6095.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 769D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B205.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3147.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5663.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6656.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E52B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 964B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C36A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A81D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C71F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8681.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 695F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22B1.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3464 wrote to memory of 4752 3464 2026-08-05_6e377be08270d4a7e9221af8c624350b_elex_mafia_stealc_tofsee.exe 87 PID 4752 wrote to memory of 2436 4752 4F54.tmp 88 PID 2436 wrote to memory of 4704 2436 502E.tmp 89 PID 4704 wrote to memory of 5032 4704 50EA.tmp 90 PID 5032 wrote to memory of 4360 5032 51E4.tmp 91 PID 4360 wrote to memory of 1240 4360 529F.tmp 92 PID 1240 wrote to memory of 3264 1240 534B.tmp 93 PID 3264 wrote to memory of 1316 3264 5416.tmp 94 PID 1316 wrote to memory of 4872 1316 54A3.tmp 95 PID 4872 wrote to memory of 1272 4872 554F.tmp 96 PID 1272 wrote to memory of 4748 1272 561A.tmp 97 PID 4748 wrote to memory of 3816 4748 56E5.tmp 98 PID 3816 wrote to memory of 2080 3816 5791.tmp 99 PID 2080 wrote to memory of 1280 2080 580E.tmp 100 PID 1280 wrote to memory of 3820 1280 58D9.tmp 101 PID 3820 wrote to memory of 2180 3820 59A4.tmp 102 PID 2180 wrote to memory of 3356 2180 5A21.tmp 103 PID 3356 wrote to memory of 3548 3356 5ADD.tmp 104 PID 3548 wrote to memory of 3256 3548 5B98.tmp 105 PID 3256 wrote to memory of 2092 3256 5C63.tmp 106 PID 2092 wrote to memory of 4684 2092 5CF0.tmp 107 PID 4684 wrote to memory of 4496 4684 5D5D.tmp 108 PID 4496 wrote to memory of 4532 4496 5DEA.tmp 109 PID 4532 wrote to memory of 3188 4532 5E86.tmp 110 PID 3188 wrote to memory of 4820 3188 5F42.tmp 111 PID 4820 wrote to memory of 1484 4820 5FDE.tmp 112 PID 1484 wrote to memory of 2100 1484 607A.tmp 113 PID 2100 wrote to memory of 4084 2100 6136.tmp 114 PID 4084 wrote to memory of 3468 4084 61B3.tmp 115 PID 3468 wrote to memory of 4624 3468 624F.tmp 116 PID 4624 wrote to memory of 3216 4624 62CC.tmp 117 PID 3216 wrote to memory of 3472 3216 6349.tmp 118 PID 3472 wrote to memory of 2896 3472 6424.tmp 119 PID 2896 wrote to memory of 468 2896 6491.tmp 120 PID 468 wrote to memory of 3016 468 64FE.tmp 121 PID 3016 wrote to memory of 4916 3016 656C.tmp 122 PID 4916 wrote to memory of 3900 4916 65BA.tmp 123 PID 3900 wrote to memory of 3628 3900 6608.tmp 124 PID 3628 wrote to memory of 1748 3628 6656.tmp 125 PID 1748 wrote to memory of 1696 1748 66B4.tmp 126 PID 1696 wrote to memory of 2724 1696 6702.tmp 127 PID 2724 wrote to memory of 1848 2724 6750.tmp 128 PID 1848 wrote to memory of 1600 1848 679E.tmp 129 PID 1600 wrote to memory of 4080 1600 67EC.tmp 130 PID 4080 wrote to memory of 1064 4080 683B.tmp 131 PID 1064 wrote to memory of 3120 1064 6889.tmp 132 PID 3120 wrote to memory of 720 3120 68D7.tmp 133 PID 720 wrote to memory of 1892 720 6925.tmp 134 PID 1892 wrote to memory of 512 1892 6973.tmp 135 PID 512 wrote to memory of 2172 512 69D1.tmp 136 PID 2172 wrote to memory of 3852 2172 6A2F.tmp 137 PID 3852 wrote to memory of 2604 3852 6A7D.tmp 138 PID 2604 wrote to memory of 1956 2604 6ADA.tmp 139 PID 2232 wrote to memory of 3380 2232 6B77.tmp 141 PID 3380 wrote to memory of 2884 3380 6BC5.tmp 142 PID 2884 wrote to memory of 1644 2884 6C13.tmp 143 PID 1644 wrote to memory of 2400 1644 6C71.tmp 144 PID 2400 wrote to memory of 3872 2400 6CDE.tmp 145 PID 3872 wrote to memory of 4412 3872 6D4B.tmp 146 PID 4412 wrote to memory of 2028 4412 6DA9.tmp 147 PID 2028 wrote to memory of 3796 2028 6DF7.tmp 148 PID 3796 wrote to memory of 676 3796 6E45.tmp 149 PID 676 wrote to memory of 4612 676 6E94.tmp 150 PID 4612 wrote to memory of 3692 4612 6EF1.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_6e377be08270d4a7e9221af8c624350b_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_6e377be08270d4a7e9221af8c624350b_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\4F54.tmp"C:\Users\Admin\AppData\Local\Temp\4F54.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\502E.tmp"C:\Users\Admin\AppData\Local\Temp\502E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\50EA.tmp"C:\Users\Admin\AppData\Local\Temp\50EA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\51E4.tmp"C:\Users\Admin\AppData\Local\Temp\51E4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\529F.tmp"C:\Users\Admin\AppData\Local\Temp\529F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\534B.tmp"C:\Users\Admin\AppData\Local\Temp\534B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\5416.tmp"C:\Users\Admin\AppData\Local\Temp\5416.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\54A3.tmp"C:\Users\Admin\AppData\Local\Temp\54A3.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\554F.tmp"C:\Users\Admin\AppData\Local\Temp\554F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\561A.tmp"C:\Users\Admin\AppData\Local\Temp\561A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\56E5.tmp"C:\Users\Admin\AppData\Local\Temp\56E5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\5791.tmp"C:\Users\Admin\AppData\Local\Temp\5791.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\580E.tmp"C:\Users\Admin\AppData\Local\Temp\580E.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\58D9.tmp"C:\Users\Admin\AppData\Local\Temp\58D9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\5C63.tmp"C:\Users\Admin\AppData\Local\Temp\5C63.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\5CF0.tmp"C:\Users\Admin\AppData\Local\Temp\5CF0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\5DEA.tmp"C:\Users\Admin\AppData\Local\Temp\5DEA.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\5E86.tmp"C:\Users\Admin\AppData\Local\Temp\5E86.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\5F42.tmp"C:\Users\Admin\AppData\Local\Temp\5F42.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\607A.tmp"C:\Users\Admin\AppData\Local\Temp\607A.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\6136.tmp"C:\Users\Admin\AppData\Local\Temp\6136.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\61B3.tmp"C:\Users\Admin\AppData\Local\Temp\61B3.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\624F.tmp"C:\Users\Admin\AppData\Local\Temp\624F.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\62CC.tmp"C:\Users\Admin\AppData\Local\Temp\62CC.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\6349.tmp"C:\Users\Admin\AppData\Local\Temp\6349.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\6424.tmp"C:\Users\Admin\AppData\Local\Temp\6424.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\6491.tmp"C:\Users\Admin\AppData\Local\Temp\6491.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\64FE.tmp"C:\Users\Admin\AppData\Local\Temp\64FE.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\656C.tmp"C:\Users\Admin\AppData\Local\Temp\656C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\65BA.tmp"C:\Users\Admin\AppData\Local\Temp\65BA.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\6608.tmp"C:\Users\Admin\AppData\Local\Temp\6608.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\6656.tmp"C:\Users\Admin\AppData\Local\Temp\6656.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\66B4.tmp"C:\Users\Admin\AppData\Local\Temp\66B4.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\6702.tmp"C:\Users\Admin\AppData\Local\Temp\6702.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\6750.tmp"C:\Users\Admin\AppData\Local\Temp\6750.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\679E.tmp"C:\Users\Admin\AppData\Local\Temp\679E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\67EC.tmp"C:\Users\Admin\AppData\Local\Temp\67EC.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\683B.tmp"C:\Users\Admin\AppData\Local\Temp\683B.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\6889.tmp"C:\Users\Admin\AppData\Local\Temp\6889.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\68D7.tmp"C:\Users\Admin\AppData\Local\Temp\68D7.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\6925.tmp"C:\Users\Admin\AppData\Local\Temp\6925.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\6973.tmp"C:\Users\Admin\AppData\Local\Temp\6973.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\69D1.tmp"C:\Users\Admin\AppData\Local\Temp\69D1.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\6A7D.tmp"C:\Users\Admin\AppData\Local\Temp\6A7D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\6ADA.tmp"C:\Users\Admin\AppData\Local\Temp\6ADA.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\6B29.tmp"C:\Users\Admin\AppData\Local\Temp\6B29.tmp"54⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\6B77.tmp"C:\Users\Admin\AppData\Local\Temp\6B77.tmp"55⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\6BC5.tmp"C:\Users\Admin\AppData\Local\Temp\6BC5.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\6C13.tmp"C:\Users\Admin\AppData\Local\Temp\6C13.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\6C71.tmp"C:\Users\Admin\AppData\Local\Temp\6C71.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\6E45.tmp"C:\Users\Admin\AppData\Local\Temp\6E45.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\6E94.tmp"C:\Users\Admin\AppData\Local\Temp\6E94.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"C:\Users\Admin\AppData\Local\Temp\6EF1.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"66⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"67⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"68⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\7039.tmp"C:\Users\Admin\AppData\Local\Temp\7039.tmp"69⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\7088.tmp"C:\Users\Admin\AppData\Local\Temp\7088.tmp"70⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\70F5.tmp"C:\Users\Admin\AppData\Local\Temp\70F5.tmp"71⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\7153.tmp"C:\Users\Admin\AppData\Local\Temp\7153.tmp"72⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\71B0.tmp"C:\Users\Admin\AppData\Local\Temp\71B0.tmp"73⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\721E.tmp"C:\Users\Admin\AppData\Local\Temp\721E.tmp"74⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\726C.tmp"C:\Users\Admin\AppData\Local\Temp\726C.tmp"75⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\72BA.tmp"C:\Users\Admin\AppData\Local\Temp\72BA.tmp"76⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\7327.tmp"C:\Users\Admin\AppData\Local\Temp\7327.tmp"77⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\7395.tmp"C:\Users\Admin\AppData\Local\Temp\7395.tmp"78⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\7402.tmp"C:\Users\Admin\AppData\Local\Temp\7402.tmp"79⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\7450.tmp"C:\Users\Admin\AppData\Local\Temp\7450.tmp"80⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\74BE.tmp"C:\Users\Admin\AppData\Local\Temp\74BE.tmp"81⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\752B.tmp"C:\Users\Admin\AppData\Local\Temp\752B.tmp"82⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\7598.tmp"C:\Users\Admin\AppData\Local\Temp\7598.tmp"83⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\7606.tmp"C:\Users\Admin\AppData\Local\Temp\7606.tmp"84⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\7654.tmp"C:\Users\Admin\AppData\Local\Temp\7654.tmp"85⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\76B2.tmp"C:\Users\Admin\AppData\Local\Temp\76B2.tmp"86⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\7700.tmp"C:\Users\Admin\AppData\Local\Temp\7700.tmp"87⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\774E.tmp"C:\Users\Admin\AppData\Local\Temp\774E.tmp"88⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\77AC.tmp"C:\Users\Admin\AppData\Local\Temp\77AC.tmp"89⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\7809.tmp"C:\Users\Admin\AppData\Local\Temp\7809.tmp"90⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\7858.tmp"C:\Users\Admin\AppData\Local\Temp\7858.tmp"91⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\78B5.tmp"C:\Users\Admin\AppData\Local\Temp\78B5.tmp"92⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\7913.tmp"C:\Users\Admin\AppData\Local\Temp\7913.tmp"93⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\7961.tmp"C:\Users\Admin\AppData\Local\Temp\7961.tmp"94⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\79CF.tmp"C:\Users\Admin\AppData\Local\Temp\79CF.tmp"95⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\7A1D.tmp"C:\Users\Admin\AppData\Local\Temp\7A1D.tmp"96⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"C:\Users\Admin\AppData\Local\Temp\7A8A.tmp"97⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\7AD8.tmp"C:\Users\Admin\AppData\Local\Temp\7AD8.tmp"98⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\7B26.tmp"C:\Users\Admin\AppData\Local\Temp\7B26.tmp"99⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\7B74.tmp"C:\Users\Admin\AppData\Local\Temp\7B74.tmp"100⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\7BE2.tmp"C:\Users\Admin\AppData\Local\Temp\7BE2.tmp"101⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\7C30.tmp"C:\Users\Admin\AppData\Local\Temp\7C30.tmp"102⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"103⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\7CFB.tmp"C:\Users\Admin\AppData\Local\Temp\7CFB.tmp"104⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\7D49.tmp"C:\Users\Admin\AppData\Local\Temp\7D49.tmp"105⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\7DB7.tmp"C:\Users\Admin\AppData\Local\Temp\7DB7.tmp"106⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\7E14.tmp"C:\Users\Admin\AppData\Local\Temp\7E14.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\7E72.tmp"C:\Users\Admin\AppData\Local\Temp\7E72.tmp"108⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"C:\Users\Admin\AppData\Local\Temp\7EDF.tmp"109⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\7F3D.tmp"C:\Users\Admin\AppData\Local\Temp\7F3D.tmp"110⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\7F8B.tmp"C:\Users\Admin\AppData\Local\Temp\7F8B.tmp"111⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\7FD9.tmp"C:\Users\Admin\AppData\Local\Temp\7FD9.tmp"112⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"113⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\8085.tmp"C:\Users\Admin\AppData\Local\Temp\8085.tmp"114⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\8131.tmp"C:\Users\Admin\AppData\Local\Temp\8131.tmp"116⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"117⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\81CD.tmp"C:\Users\Admin\AppData\Local\Temp\81CD.tmp"118⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\823B.tmp"C:\Users\Admin\AppData\Local\Temp\823B.tmp"119⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\82A8.tmp"C:\Users\Admin\AppData\Local\Temp\82A8.tmp"120⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\82F6.tmp"C:\Users\Admin\AppData\Local\Temp\82F6.tmp"121⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\8354.tmp"C:\Users\Admin\AppData\Local\Temp\8354.tmp"122⤵PID:2244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-