Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/08/2026, 12:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-06_ca4b801af51edf5d5c12c5984eabffcd_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_ca4b801af51edf5d5c12c5984eabffcd_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-06_ca4b801af51edf5d5c12c5984eabffcd_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260806-p6ebfawsds
- SHA256 4beeef3e3d64acf4943764d31a8747670bcbc8fa3fb71392b892084b0fe30a0a
- MD5 ca4b801af51edf5d5c12c5984eabffcd
- SHA1 10b0e8f33bda1d4473b53be5d8e51470401ea53f
- SHA512 6847d31d953c1c60a21d506484127c30b18615cbbdaaebc23fa0cb69f6c64306a0bd312c1554aa81993d1d976f7450392498457be23c7fdee153fd80961e50e3
- SSDEEP 12288:HU5rCOTeiJSFxzwPJWf1b6ELip9000tZhu10NZ:HUQOJJE9Nb6ELqeNU10N
- TLSH T14CB4F021B0C5C436F99202344EE6EBB15A3E7D718B2694C77B8476BE6E742E1A734307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3552 7CAD.tmp 1956 7D88.tmp 2364 7E34.tmp 2492 7F1E.tmp 1156 7FAB.tmp 4328 8047.tmp 1896 8102.tmp 2840 81BE.tmp 1640 8344.tmp 4924 83F0.tmp 4012 847D.tmp 2664 84FA.tmp 1788 85A6.tmp 3456 8661.tmp 2440 870D.tmp 2020 878A.tmp 1876 8855.tmp 5112 8911.tmp 1012 89BD.tmp 4060 8A59.tmp 3792 8AF5.tmp 2764 8B91.tmp 440 8C2E.tmp 204 8CDA.tmp 4016 8D85.tmp 3192 8DF3.tmp 1236 8E7F.tmp 3836 8F3B.tmp 2400 8FA8.tmp 2524 9054.tmp 5052 9100.tmp 1048 919C.tmp 5000 920A.tmp 1388 9287.tmp 880 92D5.tmp 4760 9342.tmp 4812 9390.tmp 1420 93DE.tmp 2844 944C.tmp 2240 949A.tmp 3036 94F8.tmp 868 9565.tmp 4072 95D2.tmp 4732 9630.tmp 3132 968E.tmp 2576 970B.tmp 4664 9778.tmp 1748 97C6.tmp 5032 9834.tmp 2204 9882.tmp 2284 98E0.tmp 1808 992E.tmp 1828 997C.tmp 456 99CA.tmp 2308 9A28.tmp 1216 9A76.tmp 2384 9AC4.tmp 4600 9B31.tmp 3600 9B9F.tmp 4244 9C0C.tmp 2264 9C6A.tmp 4872 9CB8.tmp 1996 9D16.tmp 1604 9D64.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 860E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8802.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B174.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B22F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9834.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B05F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B13A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6FF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 574E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C474.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6363.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B7CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 970B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC17.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E53B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0DA.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 876 wrote to memory of 3552 876 2026-08-06_ca4b801af51edf5d5c12c5984eabffcd_elex_mafia_stealc_tofsee.exe 87 PID 3552 wrote to memory of 1956 3552 7CAD.tmp 88 PID 1956 wrote to memory of 2364 1956 7D88.tmp 89 PID 2364 wrote to memory of 2492 2364 7E34.tmp 90 PID 2492 wrote to memory of 1156 2492 7F1E.tmp 91 PID 1156 wrote to memory of 4328 1156 7FAB.tmp 92 PID 4328 wrote to memory of 1896 4328 8047.tmp 93 PID 1896 wrote to memory of 2840 1896 8102.tmp 94 PID 2840 wrote to memory of 1640 2840 81BE.tmp 95 PID 1640 wrote to memory of 4924 1640 8344.tmp 96 PID 4924 wrote to memory of 4012 4924 83F0.tmp 97 PID 4012 wrote to memory of 2664 4012 847D.tmp 98 PID 2664 wrote to memory of 1788 2664 84FA.tmp 99 PID 1788 wrote to memory of 3456 1788 85A6.tmp 100 PID 3456 wrote to memory of 2440 3456 8661.tmp 101 PID 2440 wrote to memory of 2020 2440 870D.tmp 102 PID 2020 wrote to memory of 1876 2020 878A.tmp 103 PID 1876 wrote to memory of 5112 1876 8855.tmp 104 PID 5112 wrote to memory of 1012 5112 8911.tmp 105 PID 1012 wrote to memory of 4060 1012 89BD.tmp 106 PID 4060 wrote to memory of 3792 4060 8A59.tmp 107 PID 3792 wrote to memory of 2764 3792 8AF5.tmp 108 PID 2764 wrote to memory of 440 2764 8B91.tmp 109 PID 440 wrote to memory of 204 440 8C2E.tmp 110 PID 204 wrote to memory of 4016 204 8CDA.tmp 111 PID 4016 wrote to memory of 3192 4016 8D85.tmp 112 PID 3192 wrote to memory of 1236 3192 8DF3.tmp 113 PID 1236 wrote to memory of 3836 1236 8E7F.tmp 114 PID 3836 wrote to memory of 2400 3836 8F3B.tmp 115 PID 2400 wrote to memory of 2524 2400 8FA8.tmp 116 PID 2524 wrote to memory of 5052 2524 9054.tmp 117 PID 5052 wrote to memory of 1048 5052 9100.tmp 118 PID 1048 wrote to memory of 5000 1048 919C.tmp 119 PID 5000 wrote to memory of 1388 5000 920A.tmp 120 PID 1388 wrote to memory of 880 1388 9287.tmp 121 PID 880 wrote to memory of 4760 880 92D5.tmp 122 PID 4760 wrote to memory of 4812 4760 9342.tmp 123 PID 4812 wrote to memory of 1420 4812 9390.tmp 124 PID 1420 wrote to memory of 2844 1420 93DE.tmp 125 PID 2844 wrote to memory of 2240 2844 944C.tmp 126 PID 2240 wrote to memory of 3036 2240 949A.tmp 127 PID 3036 wrote to memory of 868 3036 94F8.tmp 128 PID 868 wrote to memory of 4072 868 9565.tmp 129 PID 4072 wrote to memory of 4732 4072 95D2.tmp 130 PID 4732 wrote to memory of 3132 4732 9630.tmp 131 PID 3132 wrote to memory of 2576 3132 968E.tmp 132 PID 2576 wrote to memory of 4664 2576 970B.tmp 133 PID 4664 wrote to memory of 1748 4664 9778.tmp 134 PID 1748 wrote to memory of 5032 1748 97C6.tmp 135 PID 5032 wrote to memory of 2204 5032 9834.tmp 136 PID 2204 wrote to memory of 2284 2204 9882.tmp 137 PID 2284 wrote to memory of 1808 2284 98E0.tmp 138 PID 1808 wrote to memory of 1828 1808 992E.tmp 139 PID 1828 wrote to memory of 456 1828 997C.tmp 140 PID 456 wrote to memory of 2308 456 99CA.tmp 141 PID 2308 wrote to memory of 1216 2308 9A28.tmp 142 PID 1216 wrote to memory of 2384 1216 9A76.tmp 143 PID 2384 wrote to memory of 4600 2384 9AC4.tmp 144 PID 4600 wrote to memory of 3600 4600 9B31.tmp 145 PID 3600 wrote to memory of 4244 3600 9B9F.tmp 146 PID 4244 wrote to memory of 2264 4244 9C0C.tmp 147 PID 2264 wrote to memory of 4872 2264 9C6A.tmp 148 PID 4872 wrote to memory of 1996 4872 9CB8.tmp 149 PID 1996 wrote to memory of 1604 1996 9D16.tmp 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_ca4b801af51edf5d5c12c5984eabffcd_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_ca4b801af51edf5d5c12c5984eabffcd_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\7CAD.tmp"C:\Users\Admin\AppData\Local\Temp\7CAD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\7D88.tmp"C:\Users\Admin\AppData\Local\Temp\7D88.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\7E34.tmp"C:\Users\Admin\AppData\Local\Temp\7E34.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\7F1E.tmp"C:\Users\Admin\AppData\Local\Temp\7F1E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\8047.tmp"C:\Users\Admin\AppData\Local\Temp\8047.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\8102.tmp"C:\Users\Admin\AppData\Local\Temp\8102.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\81BE.tmp"C:\Users\Admin\AppData\Local\Temp\81BE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\8344.tmp"C:\Users\Admin\AppData\Local\Temp\8344.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\83F0.tmp"C:\Users\Admin\AppData\Local\Temp\83F0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\847D.tmp"C:\Users\Admin\AppData\Local\Temp\847D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\84FA.tmp"C:\Users\Admin\AppData\Local\Temp\84FA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\85A6.tmp"C:\Users\Admin\AppData\Local\Temp\85A6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\8661.tmp"C:\Users\Admin\AppData\Local\Temp\8661.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\870D.tmp"C:\Users\Admin\AppData\Local\Temp\870D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\878A.tmp"C:\Users\Admin\AppData\Local\Temp\878A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\8855.tmp"C:\Users\Admin\AppData\Local\Temp\8855.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\8911.tmp"C:\Users\Admin\AppData\Local\Temp\8911.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\89BD.tmp"C:\Users\Admin\AppData\Local\Temp\89BD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\8A59.tmp"C:\Users\Admin\AppData\Local\Temp\8A59.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\8AF5.tmp"C:\Users\Admin\AppData\Local\Temp\8AF5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\8B91.tmp"C:\Users\Admin\AppData\Local\Temp\8B91.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\8C2E.tmp"C:\Users\Admin\AppData\Local\Temp\8C2E.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\8CDA.tmp"C:\Users\Admin\AppData\Local\Temp\8CDA.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\8D85.tmp"C:\Users\Admin\AppData\Local\Temp\8D85.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\8DF3.tmp"C:\Users\Admin\AppData\Local\Temp\8DF3.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\8E7F.tmp"C:\Users\Admin\AppData\Local\Temp\8E7F.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"C:\Users\Admin\AppData\Local\Temp\8F3B.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\9054.tmp"C:\Users\Admin\AppData\Local\Temp\9054.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\9100.tmp"C:\Users\Admin\AppData\Local\Temp\9100.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\919C.tmp"C:\Users\Admin\AppData\Local\Temp\919C.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\920A.tmp"C:\Users\Admin\AppData\Local\Temp\920A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\9287.tmp"C:\Users\Admin\AppData\Local\Temp\9287.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\92D5.tmp"C:\Users\Admin\AppData\Local\Temp\92D5.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\9342.tmp"C:\Users\Admin\AppData\Local\Temp\9342.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\9390.tmp"C:\Users\Admin\AppData\Local\Temp\9390.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\93DE.tmp"C:\Users\Admin\AppData\Local\Temp\93DE.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\944C.tmp"C:\Users\Admin\AppData\Local\Temp\944C.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\949A.tmp"C:\Users\Admin\AppData\Local\Temp\949A.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\94F8.tmp"C:\Users\Admin\AppData\Local\Temp\94F8.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\9565.tmp"C:\Users\Admin\AppData\Local\Temp\9565.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\95D2.tmp"C:\Users\Admin\AppData\Local\Temp\95D2.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\9630.tmp"C:\Users\Admin\AppData\Local\Temp\9630.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\968E.tmp"C:\Users\Admin\AppData\Local\Temp\968E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\970B.tmp"C:\Users\Admin\AppData\Local\Temp\970B.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\9778.tmp"C:\Users\Admin\AppData\Local\Temp\9778.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\97C6.tmp"C:\Users\Admin\AppData\Local\Temp\97C6.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\9834.tmp"C:\Users\Admin\AppData\Local\Temp\9834.tmp"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\9882.tmp"C:\Users\Admin\AppData\Local\Temp\9882.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\98E0.tmp"C:\Users\Admin\AppData\Local\Temp\98E0.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\992E.tmp"C:\Users\Admin\AppData\Local\Temp\992E.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\997C.tmp"C:\Users\Admin\AppData\Local\Temp\997C.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\99CA.tmp"C:\Users\Admin\AppData\Local\Temp\99CA.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\9A28.tmp"C:\Users\Admin\AppData\Local\Temp\9A28.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\9A76.tmp"C:\Users\Admin\AppData\Local\Temp\9A76.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\9AC4.tmp"C:\Users\Admin\AppData\Local\Temp\9AC4.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\9B31.tmp"C:\Users\Admin\AppData\Local\Temp\9B31.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\9B9F.tmp"C:\Users\Admin\AppData\Local\Temp\9B9F.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\9C0C.tmp"C:\Users\Admin\AppData\Local\Temp\9C0C.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\9C6A.tmp"C:\Users\Admin\AppData\Local\Temp\9C6A.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\9CB8.tmp"C:\Users\Admin\AppData\Local\Temp\9CB8.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\9D16.tmp"C:\Users\Admin\AppData\Local\Temp\9D16.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\9D64.tmp"C:\Users\Admin\AppData\Local\Temp\9D64.tmp"65⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\9DB2.tmp"C:\Users\Admin\AppData\Local\Temp\9DB2.tmp"66⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\9E00.tmp"C:\Users\Admin\AppData\Local\Temp\9E00.tmp"67⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\9E4E.tmp"C:\Users\Admin\AppData\Local\Temp\9E4E.tmp"68⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\9E9C.tmp"C:\Users\Admin\AppData\Local\Temp\9E9C.tmp"69⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\9EFA.tmp"C:\Users\Admin\AppData\Local\Temp\9EFA.tmp"70⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\9F48.tmp"C:\Users\Admin\AppData\Local\Temp\9F48.tmp"71⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\9F96.tmp"C:\Users\Admin\AppData\Local\Temp\9F96.tmp"72⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\A004.tmp"C:\Users\Admin\AppData\Local\Temp\A004.tmp"73⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\A081.tmp"C:\Users\Admin\AppData\Local\Temp\A081.tmp"74⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\A0DF.tmp"C:\Users\Admin\AppData\Local\Temp\A0DF.tmp"75⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\A12D.tmp"C:\Users\Admin\AppData\Local\Temp\A12D.tmp"76⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\A17B.tmp"C:\Users\Admin\AppData\Local\Temp\A17B.tmp"77⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\A1C9.tmp"C:\Users\Admin\AppData\Local\Temp\A1C9.tmp"78⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\A227.tmp"C:\Users\Admin\AppData\Local\Temp\A227.tmp"79⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\A275.tmp"C:\Users\Admin\AppData\Local\Temp\A275.tmp"80⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\A2D3.tmp"C:\Users\Admin\AppData\Local\Temp\A2D3.tmp"81⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\A330.tmp"C:\Users\Admin\AppData\Local\Temp\A330.tmp"82⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\A38E.tmp"C:\Users\Admin\AppData\Local\Temp\A38E.tmp"83⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"C:\Users\Admin\AppData\Local\Temp\A3EC.tmp"84⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\A43A.tmp"C:\Users\Admin\AppData\Local\Temp\A43A.tmp"85⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\A488.tmp"C:\Users\Admin\AppData\Local\Temp\A488.tmp"86⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\A4D6.tmp"C:\Users\Admin\AppData\Local\Temp\A4D6.tmp"87⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\A534.tmp"C:\Users\Admin\AppData\Local\Temp\A534.tmp"88⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"89⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\A62E.tmp"C:\Users\Admin\AppData\Local\Temp\A62E.tmp"90⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\A67C.tmp"C:\Users\Admin\AppData\Local\Temp\A67C.tmp"91⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"92⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"93⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\A776.tmp"C:\Users\Admin\AppData\Local\Temp\A776.tmp"94⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"95⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\A822.tmp"C:\Users\Admin\AppData\Local\Temp\A822.tmp"96⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\A880.tmp"C:\Users\Admin\AppData\Local\Temp\A880.tmp"97⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\A8CE.tmp"C:\Users\Admin\AppData\Local\Temp\A8CE.tmp"98⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\A91C.tmp"C:\Users\Admin\AppData\Local\Temp\A91C.tmp"99⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\A96A.tmp"C:\Users\Admin\AppData\Local\Temp\A96A.tmp"100⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\A9D7.tmp"C:\Users\Admin\AppData\Local\Temp\A9D7.tmp"101⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\AA26.tmp"C:\Users\Admin\AppData\Local\Temp\AA26.tmp"102⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\AA74.tmp"C:\Users\Admin\AppData\Local\Temp\AA74.tmp"103⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\AAF1.tmp"C:\Users\Admin\AppData\Local\Temp\AAF1.tmp"104⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\AB3F.tmp"C:\Users\Admin\AppData\Local\Temp\AB3F.tmp"105⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\ABAC.tmp"C:\Users\Admin\AppData\Local\Temp\ABAC.tmp"106⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\ABFA.tmp"C:\Users\Admin\AppData\Local\Temp\ABFA.tmp"107⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\AC48.tmp"C:\Users\Admin\AppData\Local\Temp\AC48.tmp"108⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\ACC5.tmp"C:\Users\Admin\AppData\Local\Temp\ACC5.tmp"109⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\AD14.tmp"C:\Users\Admin\AppData\Local\Temp\AD14.tmp"110⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\AD62.tmp"C:\Users\Admin\AppData\Local\Temp\AD62.tmp"111⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\ADB0.tmp"C:\Users\Admin\AppData\Local\Temp\ADB0.tmp"112⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\ADFE.tmp"C:\Users\Admin\AppData\Local\Temp\ADFE.tmp"113⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"C:\Users\Admin\AppData\Local\Temp\AE5C.tmp"114⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"115⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\AF17.tmp"C:\Users\Admin\AppData\Local\Temp\AF17.tmp"116⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\AF65.tmp"C:\Users\Admin\AppData\Local\Temp\AF65.tmp"117⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"118⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\B002.tmp"C:\Users\Admin\AppData\Local\Temp\B002.tmp"119⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\B05F.tmp"C:\Users\Admin\AppData\Local\Temp\B05F.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\B0DC.tmp"C:\Users\Admin\AppData\Local\Temp\B0DC.tmp"121⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\B13A.tmp"C:\Users\Admin\AppData\Local\Temp\B13A.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:3236
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-