Analysis
- max time kernel
150s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/08/2026, 10:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_2d17b89a9244d2b7cda9b1c10a0c5a79_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_2d17b89a9244d2b7cda9b1c10a0c5a79_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-14_2d17b89a9244d2b7cda9b1c10a0c5a79_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260814-mqpfcshr21
- SHA256 93d595283d73e8024fd6b9e1625acc09603630ba6cb11445fc9c8e1b9ae4bcf3
- MD5 2d17b89a9244d2b7cda9b1c10a0c5a79
- SHA1 93412fbe33fdf0cb176ead0eb67da029b3c94268
- SHA512 b629493794df89c97f78dfb50b313628de8e76bd8927b7c22dc3bc28d24bef7d3ef3f910a502d58be00a095809fa06af49e54a1fd97322938830e81768bba1e8
- SSDEEP 12288:NU5rCOTeijPvUkVI1XCA3B4BQTZwlH4Hp:NUQOJjPvUk0yA39TSlH4Hp
- TLSH T1C9B4F126B685C133D5C201320AE6EBB26A3EBC35572690C37B94673E2BB17E1D375346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4452 4FA2.tmp 2016 503E.tmp 3812 50EA.tmp 3580 51F3.tmp 4816 529F.tmp 5048 533C.tmp 4276 53E7.tmp 3272 5484.tmp 4636 5510.tmp 2324 55AD.tmp 3952 5649.tmp 2596 5714.tmp 1348 57B0.tmp 60 585C.tmp 4712 58E9.tmp 4324 5985.tmp 4788 5A21.tmp 4372 5ABD.tmp 4416 5B4A.tmp 3056 5BA8.tmp 2856 5C25.tmp 2532 5CA2.tmp 4656 5D0F.tmp 2364 5DDA.tmp 4792 5E67.tmp 868 5EE4.tmp 2000 5F61.tmp 2968 5FFD.tmp 668 60C8.tmp 1568 61B3.tmp 2308 627E.tmp 1144 632A.tmp 4196 63C6.tmp 2812 6414.tmp 3392 6462.tmp 2296 64B0.tmp 2536 64FE.tmp 3652 656C.tmp 2320 65D9.tmp 4800 6627.tmp 5008 6685.tmp 4608 66E3.tmp 3212 6741.tmp 2004 679E.tmp 2240 67FC.tmp 3604 685A.tmp 4632 68B8.tmp 2936 6915.tmp 5100 6963.tmp 3772 69B2.tmp 2800 6A00.tmp 4192 6A4E.tmp 3688 6ACB.tmp 4156 6B19.tmp 2456 6B96.tmp 3312 6C03.tmp 2428 6C61.tmp 3596 6CDE.tmp 4868 6D2C.tmp 1988 6DA9.tmp 4704 6E07.tmp 548 6E74.tmp 2356 6ED2.tmp 2832 6F20.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 283F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F335.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 352.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2939.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1042.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5838.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5886.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A42.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4702.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C752.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9783.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9621.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F4F.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4692 wrote to memory of 4452 4692 2026-08-14_2d17b89a9244d2b7cda9b1c10a0c5a79_elex_mafia_stealc_tofsee.exe 85 PID 4452 wrote to memory of 2016 4452 4FA2.tmp 86 PID 2016 wrote to memory of 3812 2016 503E.tmp 87 PID 3812 wrote to memory of 3580 3812 50EA.tmp 88 PID 3580 wrote to memory of 4816 3580 51F3.tmp 89 PID 4816 wrote to memory of 5048 4816 529F.tmp 90 PID 5048 wrote to memory of 4276 5048 533C.tmp 91 PID 4276 wrote to memory of 3272 4276 53E7.tmp 92 PID 3272 wrote to memory of 4636 3272 5484.tmp 93 PID 4636 wrote to memory of 2324 4636 5510.tmp 94 PID 2324 wrote to memory of 3952 2324 55AD.tmp 95 PID 3952 wrote to memory of 2596 3952 5649.tmp 96 PID 2596 wrote to memory of 1348 2596 5714.tmp 97 PID 1348 wrote to memory of 60 1348 57B0.tmp 98 PID 60 wrote to memory of 4712 60 585C.tmp 99 PID 4712 wrote to memory of 4324 4712 58E9.tmp 100 PID 4324 wrote to memory of 4788 4324 5985.tmp 101 PID 4788 wrote to memory of 4372 4788 5A21.tmp 102 PID 4372 wrote to memory of 4416 4372 5ABD.tmp 103 PID 4416 wrote to memory of 3056 4416 5B4A.tmp 104 PID 3056 wrote to memory of 2856 3056 5BA8.tmp 105 PID 2856 wrote to memory of 2532 2856 5C25.tmp 106 PID 2532 wrote to memory of 4656 2532 5CA2.tmp 107 PID 4656 wrote to memory of 2364 4656 5D0F.tmp 108 PID 2364 wrote to memory of 4792 2364 5DDA.tmp 109 PID 4792 wrote to memory of 868 4792 5E67.tmp 110 PID 868 wrote to memory of 2000 868 5EE4.tmp 111 PID 2000 wrote to memory of 2968 2000 5F61.tmp 112 PID 2968 wrote to memory of 668 2968 5FFD.tmp 113 PID 668 wrote to memory of 1568 668 60C8.tmp 114 PID 1568 wrote to memory of 2308 1568 61B3.tmp 115 PID 2308 wrote to memory of 1144 2308 627E.tmp 116 PID 1144 wrote to memory of 4196 1144 632A.tmp 117 PID 4196 wrote to memory of 2812 4196 63C6.tmp 118 PID 2812 wrote to memory of 3392 2812 6414.tmp 119 PID 3392 wrote to memory of 2296 3392 6462.tmp 120 PID 2296 wrote to memory of 2536 2296 64B0.tmp 121 PID 2536 wrote to memory of 3652 2536 64FE.tmp 122 PID 3652 wrote to memory of 2320 3652 656C.tmp 123 PID 2320 wrote to memory of 4800 2320 65D9.tmp 124 PID 4800 wrote to memory of 5008 4800 6627.tmp 125 PID 5008 wrote to memory of 4608 5008 6685.tmp 126 PID 4608 wrote to memory of 3212 4608 66E3.tmp 127 PID 3212 wrote to memory of 2004 3212 6741.tmp 128 PID 2004 wrote to memory of 2240 2004 679E.tmp 129 PID 2240 wrote to memory of 3604 2240 67FC.tmp 130 PID 3604 wrote to memory of 4632 3604 685A.tmp 131 PID 4632 wrote to memory of 2936 4632 68B8.tmp 132 PID 2936 wrote to memory of 5100 2936 6915.tmp 133 PID 5100 wrote to memory of 3772 5100 6963.tmp 134 PID 3772 wrote to memory of 2800 3772 69B2.tmp 135 PID 2800 wrote to memory of 4192 2800 6A00.tmp 136 PID 4192 wrote to memory of 3688 4192 6A4E.tmp 137 PID 3688 wrote to memory of 4156 3688 6ACB.tmp 138 PID 4156 wrote to memory of 2456 4156 6B19.tmp 139 PID 2456 wrote to memory of 3312 2456 6B96.tmp 140 PID 3312 wrote to memory of 2428 3312 6C03.tmp 141 PID 2428 wrote to memory of 3596 2428 6C61.tmp 142 PID 3596 wrote to memory of 4868 3596 6CDE.tmp 143 PID 4868 wrote to memory of 1988 4868 6D2C.tmp 144 PID 1988 wrote to memory of 4704 1988 6DA9.tmp 145 PID 4704 wrote to memory of 548 4704 6E07.tmp 146 PID 548 wrote to memory of 2356 548 6E74.tmp 147 PID 2356 wrote to memory of 2832 2356 6ED2.tmp 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_2d17b89a9244d2b7cda9b1c10a0c5a79_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_2d17b89a9244d2b7cda9b1c10a0c5a79_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"C:\Users\Admin\AppData\Local\Temp\4FA2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\503E.tmp"C:\Users\Admin\AppData\Local\Temp\503E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\50EA.tmp"C:\Users\Admin\AppData\Local\Temp\50EA.tmp"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\51F3.tmp"C:\Users\Admin\AppData\Local\Temp\51F3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\529F.tmp"C:\Users\Admin\AppData\Local\Temp\529F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\533C.tmp"C:\Users\Admin\AppData\Local\Temp\533C.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\53E7.tmp"C:\Users\Admin\AppData\Local\Temp\53E7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\5484.tmp"C:\Users\Admin\AppData\Local\Temp\5484.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\5510.tmp"C:\Users\Admin\AppData\Local\Temp\5510.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\55AD.tmp"C:\Users\Admin\AppData\Local\Temp\55AD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\5649.tmp"C:\Users\Admin\AppData\Local\Temp\5649.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\5714.tmp"C:\Users\Admin\AppData\Local\Temp\5714.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\57B0.tmp"C:\Users\Admin\AppData\Local\Temp\57B0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\585C.tmp"C:\Users\Admin\AppData\Local\Temp\585C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\58E9.tmp"C:\Users\Admin\AppData\Local\Temp\58E9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\5985.tmp"C:\Users\Admin\AppData\Local\Temp\5985.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\5BA8.tmp"C:\Users\Admin\AppData\Local\Temp\5BA8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\5C25.tmp"C:\Users\Admin\AppData\Local\Temp\5C25.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\5D0F.tmp"C:\Users\Admin\AppData\Local\Temp\5D0F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"C:\Users\Admin\AppData\Local\Temp\5DDA.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\5E67.tmp"C:\Users\Admin\AppData\Local\Temp\5E67.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\5F61.tmp"C:\Users\Admin\AppData\Local\Temp\5F61.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\5FFD.tmp"C:\Users\Admin\AppData\Local\Temp\5FFD.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\60C8.tmp"C:\Users\Admin\AppData\Local\Temp\60C8.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\61B3.tmp"C:\Users\Admin\AppData\Local\Temp\61B3.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\627E.tmp"C:\Users\Admin\AppData\Local\Temp\627E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\632A.tmp"C:\Users\Admin\AppData\Local\Temp\632A.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\63C6.tmp"C:\Users\Admin\AppData\Local\Temp\63C6.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\6414.tmp"C:\Users\Admin\AppData\Local\Temp\6414.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\6462.tmp"C:\Users\Admin\AppData\Local\Temp\6462.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\64B0.tmp"C:\Users\Admin\AppData\Local\Temp\64B0.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\64FE.tmp"C:\Users\Admin\AppData\Local\Temp\64FE.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\656C.tmp"C:\Users\Admin\AppData\Local\Temp\656C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\65D9.tmp"C:\Users\Admin\AppData\Local\Temp\65D9.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\6627.tmp"C:\Users\Admin\AppData\Local\Temp\6627.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\6685.tmp"C:\Users\Admin\AppData\Local\Temp\6685.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\66E3.tmp"C:\Users\Admin\AppData\Local\Temp\66E3.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\6741.tmp"C:\Users\Admin\AppData\Local\Temp\6741.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\679E.tmp"C:\Users\Admin\AppData\Local\Temp\679E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\67FC.tmp"C:\Users\Admin\AppData\Local\Temp\67FC.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\685A.tmp"C:\Users\Admin\AppData\Local\Temp\685A.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\68B8.tmp"C:\Users\Admin\AppData\Local\Temp\68B8.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\6915.tmp"C:\Users\Admin\AppData\Local\Temp\6915.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\6963.tmp"C:\Users\Admin\AppData\Local\Temp\6963.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\69B2.tmp"C:\Users\Admin\AppData\Local\Temp\69B2.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\6A00.tmp"C:\Users\Admin\AppData\Local\Temp\6A00.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\6A4E.tmp"C:\Users\Admin\AppData\Local\Temp\6A4E.tmp"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\6ACB.tmp"C:\Users\Admin\AppData\Local\Temp\6ACB.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\6B19.tmp"C:\Users\Admin\AppData\Local\Temp\6B19.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\6B96.tmp"C:\Users\Admin\AppData\Local\Temp\6B96.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\6C03.tmp"C:\Users\Admin\AppData\Local\Temp\6C03.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\6C61.tmp"C:\Users\Admin\AppData\Local\Temp\6C61.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"C:\Users\Admin\AppData\Local\Temp\6CDE.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\6E07.tmp"C:\Users\Admin\AppData\Local\Temp\6E07.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\6E74.tmp"C:\Users\Admin\AppData\Local\Temp\6E74.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\6ED2.tmp"C:\Users\Admin\AppData\Local\Temp\6ED2.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\6F20.tmp"C:\Users\Admin\AppData\Local\Temp\6F20.tmp"65⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\6F6E.tmp"C:\Users\Admin\AppData\Local\Temp\6F6E.tmp"66⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\6FBC.tmp"C:\Users\Admin\AppData\Local\Temp\6FBC.tmp"67⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\701A.tmp"C:\Users\Admin\AppData\Local\Temp\701A.tmp"68⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\7068.tmp"C:\Users\Admin\AppData\Local\Temp\7068.tmp"69⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\70C6.tmp"C:\Users\Admin\AppData\Local\Temp\70C6.tmp"70⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\7114.tmp"C:\Users\Admin\AppData\Local\Temp\7114.tmp"71⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\7162.tmp"C:\Users\Admin\AppData\Local\Temp\7162.tmp"72⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\71B0.tmp"C:\Users\Admin\AppData\Local\Temp\71B0.tmp"73⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\71FF.tmp"C:\Users\Admin\AppData\Local\Temp\71FF.tmp"74⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\724D.tmp"C:\Users\Admin\AppData\Local\Temp\724D.tmp"75⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\729B.tmp"C:\Users\Admin\AppData\Local\Temp\729B.tmp"76⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\7308.tmp"C:\Users\Admin\AppData\Local\Temp\7308.tmp"77⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\7376.tmp"C:\Users\Admin\AppData\Local\Temp\7376.tmp"78⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\73D3.tmp"C:\Users\Admin\AppData\Local\Temp\73D3.tmp"79⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\7441.tmp"C:\Users\Admin\AppData\Local\Temp\7441.tmp"80⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\749E.tmp"C:\Users\Admin\AppData\Local\Temp\749E.tmp"81⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\74ED.tmp"C:\Users\Admin\AppData\Local\Temp\74ED.tmp"82⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\755A.tmp"C:\Users\Admin\AppData\Local\Temp\755A.tmp"83⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\75B8.tmp"C:\Users\Admin\AppData\Local\Temp\75B8.tmp"84⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\7606.tmp"C:\Users\Admin\AppData\Local\Temp\7606.tmp"85⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\7664.tmp"C:\Users\Admin\AppData\Local\Temp\7664.tmp"86⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\76B2.tmp"C:\Users\Admin\AppData\Local\Temp\76B2.tmp"87⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\770F.tmp"C:\Users\Admin\AppData\Local\Temp\770F.tmp"88⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\775E.tmp"C:\Users\Admin\AppData\Local\Temp\775E.tmp"89⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\77AC.tmp"C:\Users\Admin\AppData\Local\Temp\77AC.tmp"90⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\77FA.tmp"C:\Users\Admin\AppData\Local\Temp\77FA.tmp"91⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\7848.tmp"C:\Users\Admin\AppData\Local\Temp\7848.tmp"92⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\7896.tmp"C:\Users\Admin\AppData\Local\Temp\7896.tmp"93⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\78F4.tmp"C:\Users\Admin\AppData\Local\Temp\78F4.tmp"94⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\7942.tmp"C:\Users\Admin\AppData\Local\Temp\7942.tmp"95⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\7990.tmp"C:\Users\Admin\AppData\Local\Temp\7990.tmp"96⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\79EE.tmp"C:\Users\Admin\AppData\Local\Temp\79EE.tmp"97⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"98⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\7AA9.tmp"C:\Users\Admin\AppData\Local\Temp\7AA9.tmp"99⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"100⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\7B46.tmp"C:\Users\Admin\AppData\Local\Temp\7B46.tmp"101⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"C:\Users\Admin\AppData\Local\Temp\7BC3.tmp"102⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\7C11.tmp"C:\Users\Admin\AppData\Local\Temp\7C11.tmp"103⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\7C5F.tmp"C:\Users\Admin\AppData\Local\Temp\7C5F.tmp"104⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\7CAD.tmp"C:\Users\Admin\AppData\Local\Temp\7CAD.tmp"105⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\7D1A.tmp"C:\Users\Admin\AppData\Local\Temp\7D1A.tmp"106⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\7D97.tmp"C:\Users\Admin\AppData\Local\Temp\7D97.tmp"107⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"108⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\7E34.tmp"C:\Users\Admin\AppData\Local\Temp\7E34.tmp"109⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\7E82.tmp"C:\Users\Admin\AppData\Local\Temp\7E82.tmp"110⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"111⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"112⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"113⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\8028.tmp"C:\Users\Admin\AppData\Local\Temp\8028.tmp"114⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\8085.tmp"C:\Users\Admin\AppData\Local\Temp\8085.tmp"115⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"116⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\8122.tmp"C:\Users\Admin\AppData\Local\Temp\8122.tmp"117⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\8170.tmp"C:\Users\Admin\AppData\Local\Temp\8170.tmp"118⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"119⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\822B.tmp"C:\Users\Admin\AppData\Local\Temp\822B.tmp"120⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\8289.tmp"C:\Users\Admin\AppData\Local\Temp\8289.tmp"121⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\82D7.tmp"C:\Users\Admin\AppData\Local\Temp\82D7.tmp"122⤵PID:3100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-