Analysis
- max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 08:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_bad63fba7688384e5f8b235a613c6892_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_bad63fba7688384e5f8b235a613c6892_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-09-30_bad63fba7688384e5f8b235a613c6892_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260930-j4cryaae84
- SHA256 6dc48434b859ef915e0f85e403e4d9d2a231d8f936f3931d0106f369c90a7140
- MD5 bad63fba7688384e5f8b235a613c6892
- SHA1 25e6b4c4d33d3cf90504e519adf9a2626dcad78d
- SHA512 a52a8c7e6a8a5a0bb20ed16492ef9dfa72376a0554018545259fb14cd84f20b377fb5b8ff5f4c03acec677e433da74b827583fe4f0021fdea79e0f3b6b8e91b7
- SSDEEP 12288:NU5rCOTeijPNduAmgGZ8u1V5hP2sJbqQYTmJTnllTZwlH4Hp:NUQOJjPNduAmXyOLhLNnllTSlH4Hp
- TLSH T1C0B4F116B645C132E6C202710AE6EBB2793B7C75532B94C33B94663E2FB12D1E379346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3288 B9D5.tmp 948 BA71.tmp 4484 BAFE.tmp 4788 BBE8.tmp 1712 BC75.tmp 2120 BD31.tmp 4884 BDBD.tmp 4248 BE2B.tmp 4348 BEE6.tmp 4452 BF73.tmp 2200 BFFF.tmp 3920 C09C.tmp 3204 C147.tmp 4972 C213.tmp 1132 C2DE.tmp 2656 C399.tmp 876 C416.tmp 3248 C4A3.tmp 4908 C56E.tmp 2840 C5FB.tmp 1748 C687.tmp 2660 C743.tmp 1664 C7EF.tmp 2832 C86C.tmp 1088 C927.tmp 4524 C9A4.tmp 2272 CA21.tmp 4720 CABD.tmp 1808 CB2B.tmp 4404 CBA8.tmp 1956 CC44.tmp 5052 CCFF.tmp 3664 CD9C.tmp 3176 CE09.tmp 1384 CE76.tmp 3492 CED4.tmp 4976 CF32.tmp 4360 CFBF.tmp 620 D01C.tmp 4304 D099.tmp 3724 D107.tmp 3912 D155.tmp 560 D1B3.tmp 3936 D201.tmp 4276 D24F.tmp 4200 D2AD.tmp 3648 D2FB.tmp 4552 D368.tmp 4664 D3B6.tmp 4672 D404.tmp 3192 D452.tmp 2076 D4C0.tmp 1556 D50E.tmp 3372 D55C.tmp 3976 D5AA.tmp 2428 D5F8.tmp 4816 D646.tmp 3688 D695.tmp 3880 D6E3.tmp 4792 D740.tmp 2668 D78F.tmp 5064 D7EC.tmp 3256 D85A.tmp 3400 D8A8.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6344.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 643E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B423.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 206A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2428.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A30C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 260C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C927.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 181D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E49E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 265A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2958.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8795.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3346.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3008 wrote to memory of 3288 3008 2026-09-30_bad63fba7688384e5f8b235a613c6892_elex_mafia_stealc_tofsee.exe 86 PID 3288 wrote to memory of 948 3288 B9D5.tmp 87 PID 948 wrote to memory of 4484 948 BA71.tmp 90 PID 4484 wrote to memory of 4788 4484 BAFE.tmp 92 PID 4788 wrote to memory of 1712 4788 BBE8.tmp 93 PID 1712 wrote to memory of 2120 1712 BC75.tmp 94 PID 2120 wrote to memory of 4884 2120 BD31.tmp 95 PID 4884 wrote to memory of 4248 4884 BDBD.tmp 96 PID 4248 wrote to memory of 4348 4248 BE2B.tmp 97 PID 4348 wrote to memory of 4452 4348 BEE6.tmp 98 PID 4452 wrote to memory of 2200 4452 BF73.tmp 99 PID 2200 wrote to memory of 3920 2200 BFFF.tmp 100 PID 3920 wrote to memory of 3204 3920 C09C.tmp 101 PID 3204 wrote to memory of 4972 3204 C147.tmp 102 PID 4972 wrote to memory of 1132 4972 C213.tmp 103 PID 1132 wrote to memory of 2656 1132 C2DE.tmp 104 PID 2656 wrote to memory of 876 2656 C399.tmp 105 PID 876 wrote to memory of 3248 876 C416.tmp 106 PID 3248 wrote to memory of 4908 3248 C4A3.tmp 107 PID 4908 wrote to memory of 2840 4908 C56E.tmp 108 PID 2840 wrote to memory of 1748 2840 C5FB.tmp 109 PID 1748 wrote to memory of 2660 1748 C687.tmp 112 PID 2660 wrote to memory of 1664 2660 C743.tmp 113 PID 1664 wrote to memory of 2832 1664 C7EF.tmp 114 PID 2832 wrote to memory of 1088 2832 C86C.tmp 115 PID 1088 wrote to memory of 4524 1088 C927.tmp 116 PID 4524 wrote to memory of 2272 4524 C9A4.tmp 117 PID 2272 wrote to memory of 4720 2272 CA21.tmp 118 PID 4720 wrote to memory of 1808 4720 CABD.tmp 119 PID 1808 wrote to memory of 4404 1808 CB2B.tmp 121 PID 4404 wrote to memory of 1956 4404 CBA8.tmp 122 PID 1956 wrote to memory of 5052 1956 CC44.tmp 124 PID 5052 wrote to memory of 3664 5052 CCFF.tmp 125 PID 3664 wrote to memory of 3176 3664 CD9C.tmp 126 PID 3176 wrote to memory of 1384 3176 CE09.tmp 127 PID 1384 wrote to memory of 3492 1384 CE76.tmp 128 PID 3492 wrote to memory of 4976 3492 CED4.tmp 129 PID 4976 wrote to memory of 4360 4976 CF32.tmp 130 PID 4360 wrote to memory of 620 4360 CFBF.tmp 131 PID 620 wrote to memory of 4304 620 D01C.tmp 132 PID 4304 wrote to memory of 3724 4304 D099.tmp 133 PID 3724 wrote to memory of 3912 3724 D107.tmp 134 PID 3912 wrote to memory of 560 3912 D155.tmp 135 PID 560 wrote to memory of 3936 560 D1B3.tmp 136 PID 3936 wrote to memory of 4276 3936 D201.tmp 137 PID 4276 wrote to memory of 4200 4276 D24F.tmp 138 PID 4200 wrote to memory of 3648 4200 D2AD.tmp 139 PID 3648 wrote to memory of 4552 3648 D2FB.tmp 140 PID 4552 wrote to memory of 4664 4552 D368.tmp 141 PID 4664 wrote to memory of 4672 4664 D3B6.tmp 142 PID 4672 wrote to memory of 3192 4672 D404.tmp 143 PID 3192 wrote to memory of 2076 3192 D452.tmp 144 PID 2076 wrote to memory of 1556 2076 D4C0.tmp 145 PID 1556 wrote to memory of 3372 1556 D50E.tmp 146 PID 3372 wrote to memory of 3976 3372 D55C.tmp 147 PID 3976 wrote to memory of 2428 3976 D5AA.tmp 148 PID 2428 wrote to memory of 4816 2428 D5F8.tmp 149 PID 4816 wrote to memory of 3688 4816 D646.tmp 150 PID 3688 wrote to memory of 3880 3688 D695.tmp 151 PID 3880 wrote to memory of 4792 3880 D6E3.tmp 152 PID 4792 wrote to memory of 2668 4792 D740.tmp 154 PID 2668 wrote to memory of 5064 2668 D78F.tmp 155 PID 5064 wrote to memory of 3256 5064 D7EC.tmp 156 PID 3256 wrote to memory of 3400 3256 D85A.tmp 157
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_bad63fba7688384e5f8b235a613c6892_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_bad63fba7688384e5f8b235a613c6892_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\B9D5.tmp"C:\Users\Admin\AppData\Local\Temp\B9D5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\BA71.tmp"C:\Users\Admin\AppData\Local\Temp\BA71.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\BAFE.tmp"C:\Users\Admin\AppData\Local\Temp\BAFE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\BBE8.tmp"C:\Users\Admin\AppData\Local\Temp\BBE8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\BC75.tmp"C:\Users\Admin\AppData\Local\Temp\BC75.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\BD31.tmp"C:\Users\Admin\AppData\Local\Temp\BD31.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\BDBD.tmp"C:\Users\Admin\AppData\Local\Temp\BDBD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\BE2B.tmp"C:\Users\Admin\AppData\Local\Temp\BE2B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\BEE6.tmp"C:\Users\Admin\AppData\Local\Temp\BEE6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\BF73.tmp"C:\Users\Admin\AppData\Local\Temp\BF73.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\BFFF.tmp"C:\Users\Admin\AppData\Local\Temp\BFFF.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\C09C.tmp"C:\Users\Admin\AppData\Local\Temp\C09C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\C147.tmp"C:\Users\Admin\AppData\Local\Temp\C147.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\C213.tmp"C:\Users\Admin\AppData\Local\Temp\C213.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\C2DE.tmp"C:\Users\Admin\AppData\Local\Temp\C2DE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\C399.tmp"C:\Users\Admin\AppData\Local\Temp\C399.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\C416.tmp"C:\Users\Admin\AppData\Local\Temp\C416.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\C4A3.tmp"C:\Users\Admin\AppData\Local\Temp\C4A3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\C56E.tmp"C:\Users\Admin\AppData\Local\Temp\C56E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\C5FB.tmp"C:\Users\Admin\AppData\Local\Temp\C5FB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\C687.tmp"C:\Users\Admin\AppData\Local\Temp\C687.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\C743.tmp"C:\Users\Admin\AppData\Local\Temp\C743.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\C7EF.tmp"C:\Users\Admin\AppData\Local\Temp\C7EF.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\C86C.tmp"C:\Users\Admin\AppData\Local\Temp\C86C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\C927.tmp"C:\Users\Admin\AppData\Local\Temp\C927.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\C9A4.tmp"C:\Users\Admin\AppData\Local\Temp\C9A4.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\CA21.tmp"C:\Users\Admin\AppData\Local\Temp\CA21.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\CABD.tmp"C:\Users\Admin\AppData\Local\Temp\CABD.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\CC44.tmp"C:\Users\Admin\AppData\Local\Temp\CC44.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\CD9C.tmp"C:\Users\Admin\AppData\Local\Temp\CD9C.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\CE76.tmp"C:\Users\Admin\AppData\Local\Temp\CE76.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\CED4.tmp"C:\Users\Admin\AppData\Local\Temp\CED4.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\CF32.tmp"C:\Users\Admin\AppData\Local\Temp\CF32.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\D01C.tmp"C:\Users\Admin\AppData\Local\Temp\D01C.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\D099.tmp"C:\Users\Admin\AppData\Local\Temp\D099.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\D107.tmp"C:\Users\Admin\AppData\Local\Temp\D107.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\D155.tmp"C:\Users\Admin\AppData\Local\Temp\D155.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\D1B3.tmp"C:\Users\Admin\AppData\Local\Temp\D1B3.tmp"44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\D201.tmp"C:\Users\Admin\AppData\Local\Temp\D201.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\D24F.tmp"C:\Users\Admin\AppData\Local\Temp\D24F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\D2AD.tmp"C:\Users\Admin\AppData\Local\Temp\D2AD.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\D2FB.tmp"C:\Users\Admin\AppData\Local\Temp\D2FB.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\D368.tmp"C:\Users\Admin\AppData\Local\Temp\D368.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\D3B6.tmp"C:\Users\Admin\AppData\Local\Temp\D3B6.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\D404.tmp"C:\Users\Admin\AppData\Local\Temp\D404.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\D452.tmp"C:\Users\Admin\AppData\Local\Temp\D452.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"C:\Users\Admin\AppData\Local\Temp\D4C0.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\D50E.tmp"C:\Users\Admin\AppData\Local\Temp\D50E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\D55C.tmp"C:\Users\Admin\AppData\Local\Temp\D55C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\D5AA.tmp"C:\Users\Admin\AppData\Local\Temp\D5AA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\D5F8.tmp"C:\Users\Admin\AppData\Local\Temp\D5F8.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\D646.tmp"C:\Users\Admin\AppData\Local\Temp\D646.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\D695.tmp"C:\Users\Admin\AppData\Local\Temp\D695.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\D6E3.tmp"C:\Users\Admin\AppData\Local\Temp\D6E3.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\D740.tmp"C:\Users\Admin\AppData\Local\Temp\D740.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\D78F.tmp"C:\Users\Admin\AppData\Local\Temp\D78F.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\D7EC.tmp"C:\Users\Admin\AppData\Local\Temp\D7EC.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\D85A.tmp"C:\Users\Admin\AppData\Local\Temp\D85A.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\D8A8.tmp"C:\Users\Admin\AppData\Local\Temp\D8A8.tmp"65⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\D8F6.tmp"C:\Users\Admin\AppData\Local\Temp\D8F6.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\D944.tmp"C:\Users\Admin\AppData\Local\Temp\D944.tmp"67⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\D9A2.tmp"C:\Users\Admin\AppData\Local\Temp\D9A2.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\D9F0.tmp"C:\Users\Admin\AppData\Local\Temp\D9F0.tmp"69⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\DA4E.tmp"C:\Users\Admin\AppData\Local\Temp\DA4E.tmp"70⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\DAAB.tmp"C:\Users\Admin\AppData\Local\Temp\DAAB.tmp"71⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\DAFA.tmp"C:\Users\Admin\AppData\Local\Temp\DAFA.tmp"72⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\DB48.tmp"C:\Users\Admin\AppData\Local\Temp\DB48.tmp"73⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\DBA5.tmp"C:\Users\Admin\AppData\Local\Temp\DBA5.tmp"74⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\DBF4.tmp"C:\Users\Admin\AppData\Local\Temp\DBF4.tmp"75⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\DC42.tmp"C:\Users\Admin\AppData\Local\Temp\DC42.tmp"76⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\DC90.tmp"C:\Users\Admin\AppData\Local\Temp\DC90.tmp"77⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\DCDE.tmp"C:\Users\Admin\AppData\Local\Temp\DCDE.tmp"78⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\DD4B.tmp"C:\Users\Admin\AppData\Local\Temp\DD4B.tmp"79⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\DDB9.tmp"C:\Users\Admin\AppData\Local\Temp\DDB9.tmp"80⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\DE26.tmp"C:\Users\Admin\AppData\Local\Temp\DE26.tmp"81⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\DE93.tmp"C:\Users\Admin\AppData\Local\Temp\DE93.tmp"82⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\DEF1.tmp"C:\Users\Admin\AppData\Local\Temp\DEF1.tmp"83⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\DF4F.tmp"C:\Users\Admin\AppData\Local\Temp\DF4F.tmp"84⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\DFBC.tmp"C:\Users\Admin\AppData\Local\Temp\DFBC.tmp"85⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\E00A.tmp"C:\Users\Admin\AppData\Local\Temp\E00A.tmp"86⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\E078.tmp"C:\Users\Admin\AppData\Local\Temp\E078.tmp"87⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\E0C6.tmp"C:\Users\Admin\AppData\Local\Temp\E0C6.tmp"88⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\E133.tmp"C:\Users\Admin\AppData\Local\Temp\E133.tmp"89⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\E181.tmp"C:\Users\Admin\AppData\Local\Temp\E181.tmp"90⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\E1D0.tmp"C:\Users\Admin\AppData\Local\Temp\E1D0.tmp"91⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\E21E.tmp"C:\Users\Admin\AppData\Local\Temp\E21E.tmp"92⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\E26C.tmp"C:\Users\Admin\AppData\Local\Temp\E26C.tmp"93⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\E2CA.tmp"C:\Users\Admin\AppData\Local\Temp\E2CA.tmp"94⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\E318.tmp"C:\Users\Admin\AppData\Local\Temp\E318.tmp"95⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\E366.tmp"C:\Users\Admin\AppData\Local\Temp\E366.tmp"96⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\E3B4.tmp"C:\Users\Admin\AppData\Local\Temp\E3B4.tmp"97⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\E402.tmp"C:\Users\Admin\AppData\Local\Temp\E402.tmp"98⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\E450.tmp"C:\Users\Admin\AppData\Local\Temp\E450.tmp"99⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\E49E.tmp"C:\Users\Admin\AppData\Local\Temp\E49E.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:512 -
C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\E53B.tmp"C:\Users\Admin\AppData\Local\Temp\E53B.tmp"102⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\E5A8.tmp"C:\Users\Admin\AppData\Local\Temp\E5A8.tmp"103⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\E5F6.tmp"C:\Users\Admin\AppData\Local\Temp\E5F6.tmp"104⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\E644.tmp"C:\Users\Admin\AppData\Local\Temp\E644.tmp"105⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\E6B2.tmp"C:\Users\Admin\AppData\Local\Temp\E6B2.tmp"106⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\E700.tmp"C:\Users\Admin\AppData\Local\Temp\E700.tmp"107⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\E74E.tmp"C:\Users\Admin\AppData\Local\Temp\E74E.tmp"108⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"109⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\E809.tmp"C:\Users\Admin\AppData\Local\Temp\E809.tmp"110⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\E877.tmp"C:\Users\Admin\AppData\Local\Temp\E877.tmp"111⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\E8C5.tmp"C:\Users\Admin\AppData\Local\Temp\E8C5.tmp"112⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\E913.tmp"C:\Users\Admin\AppData\Local\Temp\E913.tmp"113⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\E961.tmp"C:\Users\Admin\AppData\Local\Temp\E961.tmp"114⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\E9AF.tmp"C:\Users\Admin\AppData\Local\Temp\E9AF.tmp"115⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\EA0D.tmp"C:\Users\Admin\AppData\Local\Temp\EA0D.tmp"116⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\EA5B.tmp"C:\Users\Admin\AppData\Local\Temp\EA5B.tmp"117⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\EAB9.tmp"C:\Users\Admin\AppData\Local\Temp\EAB9.tmp"118⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\EB07.tmp"C:\Users\Admin\AppData\Local\Temp\EB07.tmp"119⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\EB55.tmp"C:\Users\Admin\AppData\Local\Temp\EB55.tmp"120⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"C:\Users\Admin\AppData\Local\Temp\EBB3.tmp"121⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\EC01.tmp"C:\Users\Admin\AppData\Local\Temp\EC01.tmp"122⤵PID:4592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-