Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 02:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_d916ce4120cb5b5a090c946056a408a3_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_d916ce4120cb5b5a090c946056a408a3_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-08_d916ce4120cb5b5a090c946056a408a3_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260808-c3yvfsbc34
- SHA256 2f9b3b1ce64a9510441194fec3f800176e6f5fbdf3db88eacd8b5d1070abf322
- MD5 d916ce4120cb5b5a090c946056a408a3
- SHA1 f5da14d8b36795f00125b926d390481c1b7ea77d
- SHA512 f7343f597a16d8d0bb8d69e383a345e6b64daefaa17635abb7bc879c0226fb301ad7f3d6e914b5b73a37641b3d63aeb8cfec816010366d1f18be7dab6fabb82a
- SSDEEP 12288:NU5rCOTeijiFM4HAsi6zf4RIrj7GNcc9jiMBTZwlH:NUQOJjMM4T7Qa7GNPjiaTSlH
- TLSH T1A2B4F029B689C532E6D212720BE6EB71697A7D31572264C73B84637E2FB42E0D734307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4776 B55.tmp 4740 BE2.tmp 1652 C4F.tmp 1964 D1A.tmp 2536 DE6.tmp 3464 E91.tmp 5100 F0E.tmp 2812 FCA.tmp 4784 1076.tmp 4832 1112.tmp 4736 11ED.tmp 2060 126A.tmp 4816 12E7.tmp 1408 1383.tmp 1800 1410.tmp 2932 147D.tmp 4764 150A.tmp 4344 1587.tmp 2748 1604.tmp 4040 16A0.tmp 3816 172D.tmp 1148 17C9.tmp 4660 1855.tmp 2944 18E2.tmp 3324 198E.tmp 3800 19FB.tmp 1736 1A98.tmp 1084 1B05.tmp 516 1BA1.tmp 4116 1C2E.tmp 3408 1CBA.tmp 2444 1D37.tmp 3708 1E03.tmp 3444 1E70.tmp 2540 1ECE.tmp 3268 1F1C.tmp 4656 1F89.tmp 1104 1FD7.tmp 2080 2025.tmp 4364 2093.tmp 1432 2100.tmp 4188 216E.tmp 2904 21DB.tmp 4284 2229.tmp 4004 2277.tmp 3960 22D5.tmp 3992 2323.tmp 1992 2371.tmp 4468 23BF.tmp 4532 240D.tmp 3296 246B.tmp 2404 24C9.tmp 4680 2527.tmp 2756 2584.tmp 5072 25D3.tmp 2252 2621.tmp 4972 266F.tmp 3892 26BD.tmp 2708 271B.tmp 1788 2769.tmp 4044 27B7.tmp 4732 2805.tmp 4252 2863.tmp 3752 28D0.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 147D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7CBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BAB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C37A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 118A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E913.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6671.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F95F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1459.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4580.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B61C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F79A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 246B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3861.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D04B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D55C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 774E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 532C.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3860 wrote to memory of 4776 3860 2026-08-08_d916ce4120cb5b5a090c946056a408a3_elex_mafia_stealc_tofsee.exe 84 PID 4776 wrote to memory of 4740 4776 B55.tmp 85 PID 4740 wrote to memory of 1652 4740 BE2.tmp 86 PID 1652 wrote to memory of 1964 1652 C4F.tmp 87 PID 1964 wrote to memory of 2536 1964 D1A.tmp 88 PID 2536 wrote to memory of 3464 2536 DE6.tmp 89 PID 3464 wrote to memory of 5100 3464 E91.tmp 90 PID 5100 wrote to memory of 2812 5100 F0E.tmp 91 PID 2812 wrote to memory of 4784 2812 FCA.tmp 92 PID 4784 wrote to memory of 4832 4784 1076.tmp 93 PID 4832 wrote to memory of 4736 4832 1112.tmp 94 PID 4736 wrote to memory of 2060 4736 11ED.tmp 95 PID 2060 wrote to memory of 4816 2060 126A.tmp 96 PID 4816 wrote to memory of 1408 4816 12E7.tmp 97 PID 1408 wrote to memory of 1800 1408 1383.tmp 98 PID 1800 wrote to memory of 2932 1800 1410.tmp 99 PID 2932 wrote to memory of 4764 2932 147D.tmp 100 PID 4764 wrote to memory of 4344 4764 150A.tmp 101 PID 4344 wrote to memory of 2748 4344 1587.tmp 102 PID 2748 wrote to memory of 4040 2748 1604.tmp 103 PID 4040 wrote to memory of 3816 4040 16A0.tmp 104 PID 3816 wrote to memory of 1148 3816 172D.tmp 105 PID 1148 wrote to memory of 4660 1148 17C9.tmp 106 PID 4660 wrote to memory of 2944 4660 1855.tmp 107 PID 2944 wrote to memory of 3324 2944 18E2.tmp 108 PID 3324 wrote to memory of 3800 3324 198E.tmp 109 PID 3800 wrote to memory of 1736 3800 19FB.tmp 110 PID 1736 wrote to memory of 1084 1736 1A98.tmp 111 PID 1084 wrote to memory of 516 1084 1B05.tmp 113 PID 516 wrote to memory of 4116 516 1BA1.tmp 114 PID 4116 wrote to memory of 3408 4116 1C2E.tmp 115 PID 3408 wrote to memory of 2444 3408 1CBA.tmp 116 PID 2444 wrote to memory of 3708 2444 1D37.tmp 117 PID 3708 wrote to memory of 3444 3708 1E03.tmp 118 PID 3444 wrote to memory of 2540 3444 1E70.tmp 121 PID 2540 wrote to memory of 3268 2540 1ECE.tmp 122 PID 3268 wrote to memory of 4656 3268 1F1C.tmp 123 PID 4656 wrote to memory of 1104 4656 1F89.tmp 124 PID 1104 wrote to memory of 2080 1104 1FD7.tmp 125 PID 2080 wrote to memory of 4364 2080 2025.tmp 126 PID 4364 wrote to memory of 1432 4364 2093.tmp 127 PID 1432 wrote to memory of 4188 1432 2100.tmp 128 PID 4188 wrote to memory of 2904 4188 216E.tmp 129 PID 2904 wrote to memory of 4284 2904 21DB.tmp 130 PID 4284 wrote to memory of 4004 4284 2229.tmp 131 PID 4004 wrote to memory of 3960 4004 2277.tmp 133 PID 3960 wrote to memory of 3992 3960 22D5.tmp 134 PID 3992 wrote to memory of 1992 3992 2323.tmp 136 PID 1992 wrote to memory of 4468 1992 2371.tmp 137 PID 4468 wrote to memory of 4532 4468 23BF.tmp 138 PID 4532 wrote to memory of 3296 4532 240D.tmp 139 PID 3296 wrote to memory of 2404 3296 246B.tmp 140 PID 2404 wrote to memory of 4680 2404 24C9.tmp 141 PID 4680 wrote to memory of 2756 4680 2527.tmp 142 PID 2756 wrote to memory of 5072 2756 2584.tmp 143 PID 5072 wrote to memory of 2252 5072 25D3.tmp 144 PID 2252 wrote to memory of 4972 2252 2621.tmp 145 PID 4972 wrote to memory of 3892 4972 266F.tmp 146 PID 3892 wrote to memory of 2708 3892 26BD.tmp 147 PID 2708 wrote to memory of 1788 2708 271B.tmp 148 PID 1788 wrote to memory of 4044 1788 2769.tmp 149 PID 4044 wrote to memory of 4732 4044 27B7.tmp 150 PID 4732 wrote to memory of 4252 4732 2805.tmp 151 PID 4252 wrote to memory of 3752 4252 2863.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_d916ce4120cb5b5a090c946056a408a3_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_d916ce4120cb5b5a090c946056a408a3_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\B55.tmp"C:\Users\Admin\AppData\Local\Temp\B55.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\BE2.tmp"C:\Users\Admin\AppData\Local\Temp\BE2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\C4F.tmp"C:\Users\Admin\AppData\Local\Temp\C4F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\FCA.tmp"C:\Users\Admin\AppData\Local\Temp\FCA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\1076.tmp"C:\Users\Admin\AppData\Local\Temp\1076.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\11ED.tmp"C:\Users\Admin\AppData\Local\Temp\11ED.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\126A.tmp"C:\Users\Admin\AppData\Local\Temp\126A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\1383.tmp"C:\Users\Admin\AppData\Local\Temp\1383.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\1410.tmp"C:\Users\Admin\AppData\Local\Temp\1410.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\1587.tmp"C:\Users\Admin\AppData\Local\Temp\1587.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\172D.tmp"C:\Users\Admin\AppData\Local\Temp\172D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\1855.tmp"C:\Users\Admin\AppData\Local\Temp\1855.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\18E2.tmp"C:\Users\Admin\AppData\Local\Temp\18E2.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\19FB.tmp"C:\Users\Admin\AppData\Local\Temp\19FB.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\1A98.tmp"C:\Users\Admin\AppData\Local\Temp\1A98.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\1B05.tmp"C:\Users\Admin\AppData\Local\Temp\1B05.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"C:\Users\Admin\AppData\Local\Temp\1BA1.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"C:\Users\Admin\AppData\Local\Temp\1C2E.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"C:\Users\Admin\AppData\Local\Temp\1CBA.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\1D37.tmp"C:\Users\Admin\AppData\Local\Temp\1D37.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\1E03.tmp"C:\Users\Admin\AppData\Local\Temp\1E03.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\1E70.tmp"C:\Users\Admin\AppData\Local\Temp\1E70.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\1F89.tmp"C:\Users\Admin\AppData\Local\Temp\1F89.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"C:\Users\Admin\AppData\Local\Temp\1FD7.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\2025.tmp"C:\Users\Admin\AppData\Local\Temp\2025.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\2093.tmp"C:\Users\Admin\AppData\Local\Temp\2093.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\2100.tmp"C:\Users\Admin\AppData\Local\Temp\2100.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\216E.tmp"C:\Users\Admin\AppData\Local\Temp\216E.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\21DB.tmp"C:\Users\Admin\AppData\Local\Temp\21DB.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\2229.tmp"C:\Users\Admin\AppData\Local\Temp\2229.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\2277.tmp"C:\Users\Admin\AppData\Local\Temp\2277.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\22D5.tmp"C:\Users\Admin\AppData\Local\Temp\22D5.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\2323.tmp"C:\Users\Admin\AppData\Local\Temp\2323.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\2371.tmp"C:\Users\Admin\AppData\Local\Temp\2371.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\23BF.tmp"C:\Users\Admin\AppData\Local\Temp\23BF.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\240D.tmp"C:\Users\Admin\AppData\Local\Temp\240D.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\246B.tmp"C:\Users\Admin\AppData\Local\Temp\246B.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\24C9.tmp"C:\Users\Admin\AppData\Local\Temp\24C9.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\2527.tmp"C:\Users\Admin\AppData\Local\Temp\2527.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\2584.tmp"C:\Users\Admin\AppData\Local\Temp\2584.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\25D3.tmp"C:\Users\Admin\AppData\Local\Temp\25D3.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\266F.tmp"C:\Users\Admin\AppData\Local\Temp\266F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\26BD.tmp"C:\Users\Admin\AppData\Local\Temp\26BD.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\271B.tmp"C:\Users\Admin\AppData\Local\Temp\271B.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\2769.tmp"C:\Users\Admin\AppData\Local\Temp\2769.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\27B7.tmp"C:\Users\Admin\AppData\Local\Temp\27B7.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\2805.tmp"C:\Users\Admin\AppData\Local\Temp\2805.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\2863.tmp"C:\Users\Admin\AppData\Local\Temp\2863.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\28D0.tmp"C:\Users\Admin\AppData\Local\Temp\28D0.tmp"65⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\291E.tmp"C:\Users\Admin\AppData\Local\Temp\291E.tmp"66⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\298C.tmp"C:\Users\Admin\AppData\Local\Temp\298C.tmp"67⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\29E9.tmp"C:\Users\Admin\AppData\Local\Temp\29E9.tmp"68⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\2A57.tmp"C:\Users\Admin\AppData\Local\Temp\2A57.tmp"69⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"C:\Users\Admin\AppData\Local\Temp\2AC4.tmp"70⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\2B12.tmp"C:\Users\Admin\AppData\Local\Temp\2B12.tmp"71⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\2B70.tmp"C:\Users\Admin\AppData\Local\Temp\2B70.tmp"72⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"C:\Users\Admin\AppData\Local\Temp\2BBE.tmp"73⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"74⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"C:\Users\Admin\AppData\Local\Temp\2C5A.tmp"75⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"76⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"C:\Users\Admin\AppData\Local\Temp\2CF7.tmp"77⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\2D45.tmp"C:\Users\Admin\AppData\Local\Temp\2D45.tmp"78⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\2D93.tmp"C:\Users\Admin\AppData\Local\Temp\2D93.tmp"79⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"80⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"C:\Users\Admin\AppData\Local\Temp\2E8D.tmp"82⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"C:\Users\Admin\AppData\Local\Temp\2EDB.tmp"83⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\2F48.tmp"C:\Users\Admin\AppData\Local\Temp\2F48.tmp"84⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"C:\Users\Admin\AppData\Local\Temp\2FB6.tmp"85⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\3004.tmp"C:\Users\Admin\AppData\Local\Temp\3004.tmp"86⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"87⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\30BF.tmp"C:\Users\Admin\AppData\Local\Temp\30BF.tmp"88⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\312D.tmp"C:\Users\Admin\AppData\Local\Temp\312D.tmp"89⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\317B.tmp"C:\Users\Admin\AppData\Local\Temp\317B.tmp"90⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\31E8.tmp"C:\Users\Admin\AppData\Local\Temp\31E8.tmp"91⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"92⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"93⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\3330.tmp"C:\Users\Admin\AppData\Local\Temp\3330.tmp"94⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"95⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"96⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\342A.tmp"C:\Users\Admin\AppData\Local\Temp\342A.tmp"97⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"98⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"99⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"100⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"101⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\35C1.tmp"C:\Users\Admin\AppData\Local\Temp\35C1.tmp"102⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\360F.tmp"C:\Users\Admin\AppData\Local\Temp\360F.tmp"103⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"104⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\36BB.tmp"C:\Users\Admin\AppData\Local\Temp\36BB.tmp"105⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\3709.tmp"C:\Users\Admin\AppData\Local\Temp\3709.tmp"106⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\3767.tmp"C:\Users\Admin\AppData\Local\Temp\3767.tmp"107⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\37C4.tmp"C:\Users\Admin\AppData\Local\Temp\37C4.tmp"108⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\3812.tmp"C:\Users\Admin\AppData\Local\Temp\3812.tmp"109⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\3861.tmp"C:\Users\Admin\AppData\Local\Temp\3861.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\38CE.tmp"C:\Users\Admin\AppData\Local\Temp\38CE.tmp"111⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\391C.tmp"C:\Users\Admin\AppData\Local\Temp\391C.tmp"112⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"113⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\39C8.tmp"C:\Users\Admin\AppData\Local\Temp\39C8.tmp"114⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\3A16.tmp"C:\Users\Admin\AppData\Local\Temp\3A16.tmp"115⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\3A64.tmp"C:\Users\Admin\AppData\Local\Temp\3A64.tmp"116⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"117⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\3B00.tmp"C:\Users\Admin\AppData\Local\Temp\3B00.tmp"118⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"119⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"120⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"121⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\3C58.tmp"C:\Users\Admin\AppData\Local\Temp\3C58.tmp"122⤵PID:5108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-