Analysis
- max time kernel
150s - max time network
119s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 17:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_1d9835382e296f7f52043f486347cbc1_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_1d9835382e296f7f52043f486347cbc1_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-10_1d9835382e296f7f52043f486347cbc1_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260810-v5tydshe84
- SHA256 bf5caaf30a3b79ef9da48d67a5e5665ee29c563403edf2c694abdae0fd3fb28b
- MD5 1d9835382e296f7f52043f486347cbc1
- SHA1 2987195b28db2eb0f21c7572032680dbb1277552
- SHA512 273e3a4aebd969c746715f9932de874dffcb9b8f381b5b7ccecef9311e623564e3c48c9579bc820ed9803d8f4e45b3e3951b8e702f1b85cadaa55af154a494d4
- SSDEEP 12288:NU5rCOTeijciSAa1MwV0eAIVuG3rItdMTZwlH:NUQOJjTUVEIR3EtdMTSlH
- TLSH T124B4F1257181C132E6D212714EE6EBB2693ABD754726A4C33B84627E2FB17E1E335307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1584 8E7F.tmp 2924 8F2B.tmp 3384 8FD7.tmp 1464 90C2.tmp 452 916D.tmp 2372 9229.tmp 2504 9304.tmp 692 93B0.tmp 2976 947B.tmp 4644 9527.tmp 4600 95F2.tmp 4700 968E.tmp 4916 972A.tmp 1780 97A7.tmp 4892 9853.tmp 3056 98C0.tmp 604 995D.tmp 1604 9A09.tmp 904 9AA5.tmp 3840 9B41.tmp 3324 9BBE.tmp 2184 9C5A.tmp 372 9CE7.tmp 1724 9D64.tmp 1524 9E10.tmp 2272 9EBC.tmp 4016 9F58.tmp 1832 A004.tmp 220 A0A0.tmp 1732 A14C.tmp 3040 A1D9.tmp 3000 A256.tmp 3132 A2E2.tmp 752 A330.tmp 2396 A38E.tmp 3296 A41B.tmp 2636 A469.tmp 3348 A4B7.tmp 4388 A505.tmp 4612 A553.tmp 3656 A5B1.tmp 4984 A60F.tmp 740 A65D.tmp 3892 A6AB.tmp 2884 A6F9.tmp 1948 A766.tmp 3240 A7B5.tmp 924 A812.tmp 1920 A870.tmp 4272 A8BE.tmp 2624 A92C.tmp 5108 A999.tmp 1804 A9E7.tmp 4968 AA45.tmp 3736 AA93.tmp 4348 AB10.tmp 4532 AB5E.tmp 3568 ABCB.tmp 1080 AC29.tmp 4648 AC77.tmp 1980 ACC5.tmp 1180 AD14.tmp 4792 AD62.tmp 2488 ADCF.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8582.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1061.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1563.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D44E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E133.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7229.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E29B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 307C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5431.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C772.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EE8.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4844 wrote to memory of 1584 4844 2026-08-10_1d9835382e296f7f52043f486347cbc1_elex_mafia_stealc_tofsee.exe 86 PID 1584 wrote to memory of 2924 1584 8E7F.tmp 87 PID 2924 wrote to memory of 3384 2924 8F2B.tmp 88 PID 3384 wrote to memory of 1464 3384 8FD7.tmp 89 PID 1464 wrote to memory of 452 1464 90C2.tmp 90 PID 452 wrote to memory of 2372 452 916D.tmp 91 PID 2372 wrote to memory of 2504 2372 9229.tmp 92 PID 2504 wrote to memory of 692 2504 9304.tmp 93 PID 692 wrote to memory of 2976 692 93B0.tmp 94 PID 2976 wrote to memory of 4644 2976 947B.tmp 95 PID 4644 wrote to memory of 4600 4644 9527.tmp 96 PID 4600 wrote to memory of 4700 4600 95F2.tmp 97 PID 4700 wrote to memory of 4916 4700 968E.tmp 98 PID 4916 wrote to memory of 1780 4916 972A.tmp 99 PID 1780 wrote to memory of 4892 1780 97A7.tmp 100 PID 4892 wrote to memory of 3056 4892 9853.tmp 101 PID 3056 wrote to memory of 604 3056 98C0.tmp 102 PID 604 wrote to memory of 1604 604 995D.tmp 103 PID 1604 wrote to memory of 904 1604 9A09.tmp 104 PID 904 wrote to memory of 3840 904 9AA5.tmp 105 PID 3840 wrote to memory of 3324 3840 9B41.tmp 106 PID 3324 wrote to memory of 2184 3324 9BBE.tmp 107 PID 2184 wrote to memory of 372 2184 9C5A.tmp 108 PID 372 wrote to memory of 1724 372 9CE7.tmp 109 PID 1724 wrote to memory of 1524 1724 9D64.tmp 110 PID 1524 wrote to memory of 2272 1524 9E10.tmp 111 PID 2272 wrote to memory of 4016 2272 9EBC.tmp 112 PID 4016 wrote to memory of 1832 4016 9F58.tmp 113 PID 1832 wrote to memory of 220 1832 A004.tmp 114 PID 220 wrote to memory of 1732 220 A0A0.tmp 115 PID 1732 wrote to memory of 3040 1732 A14C.tmp 116 PID 3040 wrote to memory of 3000 3040 A1D9.tmp 118 PID 3000 wrote to memory of 3132 3000 A256.tmp 119 PID 3132 wrote to memory of 752 3132 A2E2.tmp 120 PID 752 wrote to memory of 2396 752 A330.tmp 121 PID 2396 wrote to memory of 3296 2396 A38E.tmp 122 PID 3296 wrote to memory of 2636 3296 A41B.tmp 124 PID 2636 wrote to memory of 3348 2636 A469.tmp 126 PID 3348 wrote to memory of 4388 3348 A4B7.tmp 127 PID 4388 wrote to memory of 4612 4388 A505.tmp 128 PID 4612 wrote to memory of 3656 4612 A553.tmp 129 PID 3656 wrote to memory of 4984 3656 A5B1.tmp 131 PID 4984 wrote to memory of 740 4984 A60F.tmp 132 PID 740 wrote to memory of 3892 740 A65D.tmp 133 PID 3892 wrote to memory of 2884 3892 A6AB.tmp 134 PID 2884 wrote to memory of 1948 2884 A6F9.tmp 135 PID 1948 wrote to memory of 3240 1948 A766.tmp 136 PID 3240 wrote to memory of 924 3240 A7B5.tmp 137 PID 924 wrote to memory of 1920 924 A812.tmp 138 PID 1920 wrote to memory of 4272 1920 A870.tmp 139 PID 4272 wrote to memory of 2624 4272 A8BE.tmp 140 PID 2624 wrote to memory of 5108 2624 A92C.tmp 141 PID 5108 wrote to memory of 1804 5108 A999.tmp 142 PID 1804 wrote to memory of 4968 1804 A9E7.tmp 143 PID 4968 wrote to memory of 3736 4968 AA45.tmp 144 PID 3736 wrote to memory of 4348 3736 AA93.tmp 145 PID 4348 wrote to memory of 4532 4348 AB10.tmp 146 PID 4532 wrote to memory of 3568 4532 AB5E.tmp 147 PID 3568 wrote to memory of 1080 3568 ABCB.tmp 148 PID 1080 wrote to memory of 4648 1080 AC29.tmp 149 PID 4648 wrote to memory of 1980 4648 AC77.tmp 150 PID 1980 wrote to memory of 1180 1980 ACC5.tmp 151 PID 1180 wrote to memory of 4792 1180 AD14.tmp 152 PID 4792 wrote to memory of 2488 4792 AD62.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_1d9835382e296f7f52043f486347cbc1_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_1d9835382e296f7f52043f486347cbc1_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\8E7F.tmp"C:\Users\Admin\AppData\Local\Temp\8E7F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\8F2B.tmp"C:\Users\Admin\AppData\Local\Temp\8F2B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\8FD7.tmp"C:\Users\Admin\AppData\Local\Temp\8FD7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\90C2.tmp"C:\Users\Admin\AppData\Local\Temp\90C2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\916D.tmp"C:\Users\Admin\AppData\Local\Temp\916D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\9229.tmp"C:\Users\Admin\AppData\Local\Temp\9229.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\9304.tmp"C:\Users\Admin\AppData\Local\Temp\9304.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\93B0.tmp"C:\Users\Admin\AppData\Local\Temp\93B0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\947B.tmp"C:\Users\Admin\AppData\Local\Temp\947B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\9527.tmp"C:\Users\Admin\AppData\Local\Temp\9527.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\95F2.tmp"C:\Users\Admin\AppData\Local\Temp\95F2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\968E.tmp"C:\Users\Admin\AppData\Local\Temp\968E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\972A.tmp"C:\Users\Admin\AppData\Local\Temp\972A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\97A7.tmp"C:\Users\Admin\AppData\Local\Temp\97A7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\9853.tmp"C:\Users\Admin\AppData\Local\Temp\9853.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\98C0.tmp"C:\Users\Admin\AppData\Local\Temp\98C0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\995D.tmp"C:\Users\Admin\AppData\Local\Temp\995D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
C:\Users\Admin\AppData\Local\Temp\9A09.tmp"C:\Users\Admin\AppData\Local\Temp\9A09.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\9AA5.tmp"C:\Users\Admin\AppData\Local\Temp\9AA5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Users\Admin\AppData\Local\Temp\9B41.tmp"C:\Users\Admin\AppData\Local\Temp\9B41.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\9BBE.tmp"C:\Users\Admin\AppData\Local\Temp\9BBE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\9C5A.tmp"C:\Users\Admin\AppData\Local\Temp\9C5A.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\9CE7.tmp"C:\Users\Admin\AppData\Local\Temp\9CE7.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\9D64.tmp"C:\Users\Admin\AppData\Local\Temp\9D64.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\9E10.tmp"C:\Users\Admin\AppData\Local\Temp\9E10.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\9F58.tmp"C:\Users\Admin\AppData\Local\Temp\9F58.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\A004.tmp"C:\Users\Admin\AppData\Local\Temp\A004.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\A0A0.tmp"C:\Users\Admin\AppData\Local\Temp\A0A0.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\A14C.tmp"C:\Users\Admin\AppData\Local\Temp\A14C.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\A1D9.tmp"C:\Users\Admin\AppData\Local\Temp\A1D9.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\A256.tmp"C:\Users\Admin\AppData\Local\Temp\A256.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\A2E2.tmp"C:\Users\Admin\AppData\Local\Temp\A2E2.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\A330.tmp"C:\Users\Admin\AppData\Local\Temp\A330.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\A38E.tmp"C:\Users\Admin\AppData\Local\Temp\A38E.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\A41B.tmp"C:\Users\Admin\AppData\Local\Temp\A41B.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\A469.tmp"C:\Users\Admin\AppData\Local\Temp\A469.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\A4B7.tmp"C:\Users\Admin\AppData\Local\Temp\A4B7.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\A505.tmp"C:\Users\Admin\AppData\Local\Temp\A505.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\A553.tmp"C:\Users\Admin\AppData\Local\Temp\A553.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\A60F.tmp"C:\Users\Admin\AppData\Local\Temp\A60F.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\A65D.tmp"C:\Users\Admin\AppData\Local\Temp\A65D.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\A766.tmp"C:\Users\Admin\AppData\Local\Temp\A766.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\A7B5.tmp"C:\Users\Admin\AppData\Local\Temp\A7B5.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\A812.tmp"C:\Users\Admin\AppData\Local\Temp\A812.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\A870.tmp"C:\Users\Admin\AppData\Local\Temp\A870.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\A8BE.tmp"C:\Users\Admin\AppData\Local\Temp\A8BE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\A92C.tmp"C:\Users\Admin\AppData\Local\Temp\A92C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\A999.tmp"C:\Users\Admin\AppData\Local\Temp\A999.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\A9E7.tmp"C:\Users\Admin\AppData\Local\Temp\A9E7.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\AA45.tmp"C:\Users\Admin\AppData\Local\Temp\AA45.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\AA93.tmp"C:\Users\Admin\AppData\Local\Temp\AA93.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\AB10.tmp"C:\Users\Admin\AppData\Local\Temp\AB10.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\AB5E.tmp"C:\Users\Admin\AppData\Local\Temp\AB5E.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\ABCB.tmp"C:\Users\Admin\AppData\Local\Temp\ABCB.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\AC29.tmp"C:\Users\Admin\AppData\Local\Temp\AC29.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\AC77.tmp"C:\Users\Admin\AppData\Local\Temp\AC77.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\ACC5.tmp"C:\Users\Admin\AppData\Local\Temp\ACC5.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\AD14.tmp"C:\Users\Admin\AppData\Local\Temp\AD14.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\AD62.tmp"C:\Users\Admin\AppData\Local\Temp\AD62.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\ADCF.tmp"C:\Users\Admin\AppData\Local\Temp\ADCF.tmp"65⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\AE2D.tmp"C:\Users\Admin\AppData\Local\Temp\AE2D.tmp"66⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\AE7B.tmp"C:\Users\Admin\AppData\Local\Temp\AE7B.tmp"67⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\AED9.tmp"C:\Users\Admin\AppData\Local\Temp\AED9.tmp"68⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\AF36.tmp"C:\Users\Admin\AppData\Local\Temp\AF36.tmp"69⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\AF94.tmp"C:\Users\Admin\AppData\Local\Temp\AF94.tmp"70⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\AFF2.tmp"C:\Users\Admin\AppData\Local\Temp\AFF2.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\B05F.tmp"C:\Users\Admin\AppData\Local\Temp\B05F.tmp"72⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\B0BD.tmp"C:\Users\Admin\AppData\Local\Temp\B0BD.tmp"73⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\B10B.tmp"C:\Users\Admin\AppData\Local\Temp\B10B.tmp"74⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\B159.tmp"C:\Users\Admin\AppData\Local\Temp\B159.tmp"75⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\B1C7.tmp"C:\Users\Admin\AppData\Local\Temp\B1C7.tmp"76⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\B244.tmp"C:\Users\Admin\AppData\Local\Temp\B244.tmp"77⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\B292.tmp"C:\Users\Admin\AppData\Local\Temp\B292.tmp"78⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\B2FF.tmp"C:\Users\Admin\AppData\Local\Temp\B2FF.tmp"79⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\B35D.tmp"C:\Users\Admin\AppData\Local\Temp\B35D.tmp"80⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\B3AB.tmp"C:\Users\Admin\AppData\Local\Temp\B3AB.tmp"81⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\B3F9.tmp"C:\Users\Admin\AppData\Local\Temp\B3F9.tmp"82⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\B476.tmp"C:\Users\Admin\AppData\Local\Temp\B476.tmp"83⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\B4D4.tmp"C:\Users\Admin\AppData\Local\Temp\B4D4.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\B541.tmp"C:\Users\Admin\AppData\Local\Temp\B541.tmp"85⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\B59F.tmp"C:\Users\Admin\AppData\Local\Temp\B59F.tmp"86⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\B5ED.tmp"C:\Users\Admin\AppData\Local\Temp\B5ED.tmp"87⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\B66A.tmp"C:\Users\Admin\AppData\Local\Temp\B66A.tmp"88⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\B6C8.tmp"C:\Users\Admin\AppData\Local\Temp\B6C8.tmp"89⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\B716.tmp"C:\Users\Admin\AppData\Local\Temp\B716.tmp"90⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\B764.tmp"C:\Users\Admin\AppData\Local\Temp\B764.tmp"91⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"C:\Users\Admin\AppData\Local\Temp\B7B2.tmp"92⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\B800.tmp"C:\Users\Admin\AppData\Local\Temp\B800.tmp"93⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\B84F.tmp"C:\Users\Admin\AppData\Local\Temp\B84F.tmp"94⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\B89D.tmp"C:\Users\Admin\AppData\Local\Temp\B89D.tmp"95⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"C:\Users\Admin\AppData\Local\Temp\B8FA.tmp"96⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\B977.tmp"C:\Users\Admin\AppData\Local\Temp\B977.tmp"97⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\B9D5.tmp"C:\Users\Admin\AppData\Local\Temp\B9D5.tmp"98⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\BA23.tmp"C:\Users\Admin\AppData\Local\Temp\BA23.tmp"99⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\BA71.tmp"C:\Users\Admin\AppData\Local\Temp\BA71.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\BADF.tmp"C:\Users\Admin\AppData\Local\Temp\BADF.tmp"101⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\BB2D.tmp"C:\Users\Admin\AppData\Local\Temp\BB2D.tmp"102⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\BB8B.tmp"C:\Users\Admin\AppData\Local\Temp\BB8B.tmp"103⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\BBF8.tmp"C:\Users\Admin\AppData\Local\Temp\BBF8.tmp"104⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\BC46.tmp"C:\Users\Admin\AppData\Local\Temp\BC46.tmp"105⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\BC94.tmp"C:\Users\Admin\AppData\Local\Temp\BC94.tmp"106⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\BD02.tmp"C:\Users\Admin\AppData\Local\Temp\BD02.tmp"107⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\BD50.tmp"C:\Users\Admin\AppData\Local\Temp\BD50.tmp"108⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\BD9E.tmp"C:\Users\Admin\AppData\Local\Temp\BD9E.tmp"109⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\BE0B.tmp"C:\Users\Admin\AppData\Local\Temp\BE0B.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:824 -
C:\Users\Admin\AppData\Local\Temp\BE79.tmp"C:\Users\Admin\AppData\Local\Temp\BE79.tmp"111⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\BEE6.tmp"C:\Users\Admin\AppData\Local\Temp\BEE6.tmp"112⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\BF44.tmp"C:\Users\Admin\AppData\Local\Temp\BF44.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:640 -
C:\Users\Admin\AppData\Local\Temp\BFA2.tmp"C:\Users\Admin\AppData\Local\Temp\BFA2.tmp"114⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\BFFF.tmp"C:\Users\Admin\AppData\Local\Temp\BFFF.tmp"115⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\C06D.tmp"C:\Users\Admin\AppData\Local\Temp\C06D.tmp"116⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\C0CA.tmp"C:\Users\Admin\AppData\Local\Temp\C0CA.tmp"117⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\C119.tmp"C:\Users\Admin\AppData\Local\Temp\C119.tmp"118⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\C167.tmp"C:\Users\Admin\AppData\Local\Temp\C167.tmp"119⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"120⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\C213.tmp"C:\Users\Admin\AppData\Local\Temp\C213.tmp"121⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\C261.tmp"C:\Users\Admin\AppData\Local\Temp\C261.tmp"122⤵PID:4664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-