Analysis
- max time kernel
150s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 14:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_8e6c946f99c0571444e94c556ae46ac6_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_8e6c946f99c0571444e94c556ae46ac6_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-09_8e6c946f99c0571444e94c556ae46ac6_elex_mafia_stealc_tofsee.exe
- Size 546KB
- Sample260809-rc34taygrd
- SHA256 60a546d7d96a70259df26ca32f7d01e072b45c0d754eed40b9e97f769b0206de
- MD5 8e6c946f99c0571444e94c556ae46ac6
- SHA1 b24e72b7a76dbb01be003f1819bbbe6fc83c4eca
- SHA512 85e84140a941dca0a971b964707fa4c669c57fe3a3a071dc9e0c9ce8f9a99122c024ffaff5e10320aa734755566f516d89d860408aee98c8ddd6a0c7005292a3
- SSDEEP 12288:9U5rCOTei6chwwvch9m27QTOOHm84IkSamqZoXWjdq:9UQOJ6chwbZUOO5kSamqqGh
- TLSH T1C3C4F125B584C032E99212310EE6EBB1697BBC314725A4C77B907B6E6FB12E1E774307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4236 FB09.tmp 3400 FBB5.tmp 5224 FC80.tmp 1768 FD1D.tmp 3104 FDA9.tmp 4952 FE74.tmp 6028 FF01.tmp 400 FFBD.tmp 2860 B7.tmp 3816 182.tmp 532 23D.tmp 1216 2F9.tmp 5060 3A5.tmp 5448 470.tmp 2848 52B.tmp 2892 5A8.tmp 2672 644.tmp 5644 6A2.tmp 5916 72F.tmp 4520 7FA.tmp 5704 8A6.tmp 3064 942.tmp 6004 9BF.tmp 456 A7B.tmp 4932 AF8.tmp 4200 B94.tmp 3968 C20.tmp 6080 C9D.tmp 1048 D1A.tmp 5128 DD6.tmp 5504 E63.tmp 5492 F0E.tmp 1696 FAB.tmp 5536 1018.tmp 2092 1076.tmp 4460 10D4.tmp 4524 1122.tmp 3928 117F.tmp 5300 11DD.tmp 2016 122B.tmp 5680 1279.tmp 5280 12C8.tmp 4956 1316.tmp 5876 1373.tmp 1264 13D1.tmp 3764 141F.tmp 4140 147D.tmp 404 14CB.tmp 3444 1519.tmp 5924 1567.tmp 5148 15D5.tmp 1620 1633.tmp 5496 1690.tmp 2708 16EE.tmp 720 173C.tmp 2696 178A.tmp 3524 17E8.tmp 4260 1836.tmp 6096 18A4.tmp 5092 18F2.tmp 3348 1940.tmp 5920 198E.tmp 3000 19DC.tmp 5084 1A49.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2016.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3803.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5697.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 178A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9313.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAA0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D79E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 386B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D702.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 533C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4522.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5743.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7078.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 755A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8410.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A92C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1373.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3592.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3851.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 817F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81CD.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4772 wrote to memory of 4236 4772 2026-08-09_8e6c946f99c0571444e94c556ae46ac6_elex_mafia_stealc_tofsee.exe 86 PID 4236 wrote to memory of 3400 4236 FB09.tmp 87 PID 3400 wrote to memory of 5224 3400 FBB5.tmp 88 PID 5224 wrote to memory of 1768 5224 FC80.tmp 89 PID 1768 wrote to memory of 3104 1768 FD1D.tmp 90 PID 3104 wrote to memory of 4952 3104 FDA9.tmp 91 PID 4952 wrote to memory of 6028 4952 FE74.tmp 92 PID 6028 wrote to memory of 400 6028 FF01.tmp 93 PID 400 wrote to memory of 2860 400 FFBD.tmp 94 PID 2860 wrote to memory of 3816 2860 B7.tmp 95 PID 3816 wrote to memory of 532 3816 182.tmp 96 PID 532 wrote to memory of 1216 532 23D.tmp 97 PID 1216 wrote to memory of 5060 1216 2F9.tmp 98 PID 5060 wrote to memory of 5448 5060 3A5.tmp 99 PID 5448 wrote to memory of 2848 5448 470.tmp 100 PID 2848 wrote to memory of 2892 2848 52B.tmp 101 PID 2892 wrote to memory of 2672 2892 5A8.tmp 102 PID 2672 wrote to memory of 5644 2672 644.tmp 103 PID 5644 wrote to memory of 5916 5644 6A2.tmp 104 PID 5916 wrote to memory of 4520 5916 72F.tmp 105 PID 4520 wrote to memory of 5704 4520 7FA.tmp 106 PID 5704 wrote to memory of 3064 5704 8A6.tmp 107 PID 3064 wrote to memory of 6004 3064 942.tmp 108 PID 6004 wrote to memory of 456 6004 9BF.tmp 109 PID 456 wrote to memory of 4932 456 A7B.tmp 110 PID 4932 wrote to memory of 4200 4932 AF8.tmp 111 PID 4200 wrote to memory of 3968 4200 B94.tmp 112 PID 3968 wrote to memory of 6080 3968 C20.tmp 113 PID 6080 wrote to memory of 1048 6080 C9D.tmp 114 PID 1048 wrote to memory of 5128 1048 D1A.tmp 115 PID 5128 wrote to memory of 5504 5128 DD6.tmp 116 PID 5504 wrote to memory of 5492 5504 E63.tmp 117 PID 5492 wrote to memory of 1696 5492 F0E.tmp 118 PID 1696 wrote to memory of 5536 1696 FAB.tmp 119 PID 5536 wrote to memory of 2092 5536 1018.tmp 120 PID 2092 wrote to memory of 4460 2092 1076.tmp 121 PID 4460 wrote to memory of 4524 4460 10D4.tmp 122 PID 4524 wrote to memory of 3928 4524 1122.tmp 123 PID 3928 wrote to memory of 5300 3928 117F.tmp 124 PID 5300 wrote to memory of 2016 5300 11DD.tmp 125 PID 2016 wrote to memory of 5680 2016 122B.tmp 126 PID 5680 wrote to memory of 5280 5680 1279.tmp 127 PID 5280 wrote to memory of 4956 5280 12C8.tmp 128 PID 4956 wrote to memory of 5876 4956 1316.tmp 129 PID 5876 wrote to memory of 1264 5876 1373.tmp 130 PID 1264 wrote to memory of 3764 1264 13D1.tmp 131 PID 3764 wrote to memory of 4140 3764 141F.tmp 132 PID 4140 wrote to memory of 404 4140 147D.tmp 133 PID 404 wrote to memory of 3444 404 14CB.tmp 134 PID 3444 wrote to memory of 5924 3444 1519.tmp 135 PID 5924 wrote to memory of 5148 5924 1567.tmp 136 PID 5148 wrote to memory of 1620 5148 15D5.tmp 137 PID 1620 wrote to memory of 5496 1620 1633.tmp 138 PID 5496 wrote to memory of 2708 5496 1690.tmp 139 PID 2708 wrote to memory of 720 2708 16EE.tmp 140 PID 720 wrote to memory of 2696 720 173C.tmp 141 PID 2696 wrote to memory of 3524 2696 178A.tmp 142 PID 3524 wrote to memory of 4260 3524 17E8.tmp 143 PID 4260 wrote to memory of 6096 4260 1836.tmp 144 PID 6096 wrote to memory of 5092 6096 18A4.tmp 145 PID 5092 wrote to memory of 3348 5092 18F2.tmp 146 PID 3348 wrote to memory of 5920 3348 1940.tmp 147 PID 5920 wrote to memory of 3000 5920 198E.tmp 148 PID 3000 wrote to memory of 5084 3000 19DC.tmp 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_8e6c946f99c0571444e94c556ae46ac6_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_8e6c946f99c0571444e94c556ae46ac6_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\FB09.tmp"C:\Users\Admin\AppData\Local\Temp\FB09.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\FC80.tmp"C:\Users\Admin\AppData\Local\Temp\FC80.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"C:\Users\Admin\AppData\Local\Temp\FD1D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"C:\Users\Admin\AppData\Local\Temp\FDA9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\FE74.tmp"C:\Users\Admin\AppData\Local\Temp\FE74.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\FF01.tmp"C:\Users\Admin\AppData\Local\Temp\FF01.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6028 -
C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\182.tmp"C:\Users\Admin\AppData\Local\Temp\182.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\2F9.tmp"C:\Users\Admin\AppData\Local\Temp\2F9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\3A5.tmp"C:\Users\Admin\AppData\Local\Temp\3A5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\470.tmp"C:\Users\Admin\AppData\Local\Temp\470.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Users\Admin\AppData\Local\Temp\52B.tmp"C:\Users\Admin\AppData\Local\Temp\52B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\6A2.tmp"C:\Users\Admin\AppData\Local\Temp\6A2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5644 -
C:\Users\Admin\AppData\Local\Temp\72F.tmp"C:\Users\Admin\AppData\Local\Temp\72F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\7FA.tmp"C:\Users\Admin\AppData\Local\Temp\7FA.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\942.tmp"C:\Users\Admin\AppData\Local\Temp\942.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\9BF.tmp"C:\Users\Admin\AppData\Local\Temp\9BF.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6004 -
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\AF8.tmp"C:\Users\Admin\AppData\Local\Temp\AF8.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\B94.tmp"C:\Users\Admin\AppData\Local\Temp\B94.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\C20.tmp"C:\Users\Admin\AppData\Local\Temp\C20.tmp"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\C9D.tmp"C:\Users\Admin\AppData\Local\Temp\C9D.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\E63.tmp"C:\Users\Admin\AppData\Local\Temp\E63.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\FAB.tmp"C:\Users\Admin\AppData\Local\Temp\FAB.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\1018.tmp"C:\Users\Admin\AppData\Local\Temp\1018.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\1122.tmp"C:\Users\Admin\AppData\Local\Temp\1122.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\117F.tmp"C:\Users\Admin\AppData\Local\Temp\117F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\11DD.tmp"C:\Users\Admin\AppData\Local\Temp\11DD.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\122B.tmp"C:\Users\Admin\AppData\Local\Temp\122B.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\1279.tmp"C:\Users\Admin\AppData\Local\Temp\1279.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\12C8.tmp"C:\Users\Admin\AppData\Local\Temp\12C8.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\1316.tmp"C:\Users\Admin\AppData\Local\Temp\1316.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5876 -
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\141F.tmp"C:\Users\Admin\AppData\Local\Temp\141F.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\14CB.tmp"C:\Users\Admin\AppData\Local\Temp\14CB.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\1519.tmp"C:\Users\Admin\AppData\Local\Temp\1519.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5924 -
C:\Users\Admin\AppData\Local\Temp\15D5.tmp"C:\Users\Admin\AppData\Local\Temp\15D5.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Users\Admin\AppData\Local\Temp\1633.tmp"C:\Users\Admin\AppData\Local\Temp\1633.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\178A.tmp"C:\Users\Admin\AppData\Local\Temp\178A.tmp"57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\17E8.tmp"C:\Users\Admin\AppData\Local\Temp\17E8.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\18A4.tmp"C:\Users\Admin\AppData\Local\Temp\18A4.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\1940.tmp"C:\Users\Admin\AppData\Local\Temp\1940.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\19DC.tmp"C:\Users\Admin\AppData\Local\Temp\19DC.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\1A49.tmp"C:\Users\Admin\AppData\Local\Temp\1A49.tmp"65⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"66⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"C:\Users\Admin\AppData\Local\Temp\1AE6.tmp"67⤵
- System Location Discovery: System Language Discovery
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\1B34.tmp"C:\Users\Admin\AppData\Local\Temp\1B34.tmp"68⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"69⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"C:\Users\Admin\AppData\Local\Temp\1BFF.tmp"70⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"71⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"C:\Users\Admin\AppData\Local\Temp\1C9B.tmp"72⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"C:\Users\Admin\AppData\Local\Temp\1CE9.tmp"73⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\1D37.tmp"C:\Users\Admin\AppData\Local\Temp\1D37.tmp"74⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\1D86.tmp"C:\Users\Admin\AppData\Local\Temp\1D86.tmp"75⤵PID:5736
-
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"76⤵PID:5660
-
C:\Users\Admin\AppData\Local\Temp\1E31.tmp"C:\Users\Admin\AppData\Local\Temp\1E31.tmp"77⤵PID:5624
-
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"78⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"79⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"C:\Users\Admin\AppData\Local\Temp\1F2B.tmp"80⤵PID:5460
-
C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"81⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"82⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\2016.tmp"C:\Users\Admin\AppData\Local\Temp\2016.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:612 -
C:\Users\Admin\AppData\Local\Temp\2083.tmp"C:\Users\Admin\AppData\Local\Temp\2083.tmp"84⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\20F1.tmp"C:\Users\Admin\AppData\Local\Temp\20F1.tmp"85⤵PID:5596
-
C:\Users\Admin\AppData\Local\Temp\215E.tmp"C:\Users\Admin\AppData\Local\Temp\215E.tmp"86⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\21CB.tmp"C:\Users\Admin\AppData\Local\Temp\21CB.tmp"87⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\2239.tmp"C:\Users\Admin\AppData\Local\Temp\2239.tmp"88⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\2287.tmp"C:\Users\Admin\AppData\Local\Temp\2287.tmp"89⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"90⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\2342.tmp"C:\Users\Admin\AppData\Local\Temp\2342.tmp"91⤵PID:5328
-
C:\Users\Admin\AppData\Local\Temp\2390.tmp"C:\Users\Admin\AppData\Local\Temp\2390.tmp"92⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\23DF.tmp"C:\Users\Admin\AppData\Local\Temp\23DF.tmp"93⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\243C.tmp"C:\Users\Admin\AppData\Local\Temp\243C.tmp"94⤵PID:5808
-
C:\Users\Admin\AppData\Local\Temp\249A.tmp"C:\Users\Admin\AppData\Local\Temp\249A.tmp"95⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\24F8.tmp"C:\Users\Admin\AppData\Local\Temp\24F8.tmp"96⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\2546.tmp"C:\Users\Admin\AppData\Local\Temp\2546.tmp"97⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\2594.tmp"C:\Users\Admin\AppData\Local\Temp\2594.tmp"98⤵PID:5216
-
C:\Users\Admin\AppData\Local\Temp\25E2.tmp"C:\Users\Admin\AppData\Local\Temp\25E2.tmp"99⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\2630.tmp"C:\Users\Admin\AppData\Local\Temp\2630.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\267E.tmp"C:\Users\Admin\AppData\Local\Temp\267E.tmp"101⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\26CD.tmp"C:\Users\Admin\AppData\Local\Temp\26CD.tmp"102⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\272A.tmp"C:\Users\Admin\AppData\Local\Temp\272A.tmp"103⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\2798.tmp"C:\Users\Admin\AppData\Local\Temp\2798.tmp"104⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\27E6.tmp"C:\Users\Admin\AppData\Local\Temp\27E6.tmp"105⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"106⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\28A1.tmp"C:\Users\Admin\AppData\Local\Temp\28A1.tmp"107⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"108⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\294D.tmp"C:\Users\Admin\AppData\Local\Temp\294D.tmp"109⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\299B.tmp"C:\Users\Admin\AppData\Local\Temp\299B.tmp"110⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\2A09.tmp"C:\Users\Admin\AppData\Local\Temp\2A09.tmp"111⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\2A57.tmp"C:\Users\Admin\AppData\Local\Temp\2A57.tmp"112⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"113⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\2B32.tmp"C:\Users\Admin\AppData\Local\Temp\2B32.tmp"114⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"115⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"116⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"117⤵PID:5372
-
C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"C:\Users\Admin\AppData\Local\Temp\2C7A.tmp"118⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"119⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\2D16.tmp"C:\Users\Admin\AppData\Local\Temp\2D16.tmp"120⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\2D64.tmp"C:\Users\Admin\AppData\Local\Temp\2D64.tmp"121⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"C:\Users\Admin\AppData\Local\Temp\2DB2.tmp"122⤵PID:4440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-