Analysis
- max time kernel
150s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/10/2026, 18:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-29_0034853a80654704ecaa44a304da5480_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-29_0034853a80654704ecaa44a304da5480_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-29_0034853a80654704ecaa44a304da5480_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample261029-wpw89adv9s
- SHA256 c492f200bbb9b4103e8cf346c40c4e6152a6586ab0bb09acb347b2c8c3d3d5cf
- MD5 0034853a80654704ecaa44a304da5480
- SHA1 1e6057c3123b1b304f5caf98c3e8f72eb1d7130a
- SHA512 8f341c69d09ebe3f7780477e52b41e9dcca47a2fd6b5afdb4979d3789cdeb2f2441638fca16fb6d7fb5afc32c41df9073f7d9b7db6e1cc2339eb6536ed1c1e7d
- SSDEEP 12288:NU5rCOTeijEcTsIFFMNrSngFubHBfrTZwlH4Hp:NUQOJjEcIIHgrkTlrTSlH4Hp
- TLSH T160B4F1267685C233E69202714BD7EBE16E3F7C754726A4C32B84622E2BB27D1D375306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3004 71A1.tmp 4664 724D.tmp 3308 7327.tmp 2908 73B4.tmp 1404 7450.tmp 816 74FC.tmp 1800 7589.tmp 4680 7615.tmp 4912 76B2.tmp 4992 772F.tmp 1080 77BB.tmp 5064 7886.tmp 824 7923.tmp 3716 79BF.tmp 5088 7A3C.tmp 4356 7AC9.tmp 2636 7B84.tmp 2464 7C20.tmp 1232 7CAD.tmp 3104 7D0B.tmp 5076 7DC6.tmp 4576 7E34.tmp 1252 7EFF.tmp 2448 7F7C.tmp 1312 8037.tmp 1704 80E3.tmp 4012 81AE.tmp 1464 826A.tmp 3496 82F6.tmp 204 83A2.tmp 4620 843E.tmp 2168 84FA.tmp 2728 8596.tmp 2664 85F4.tmp 4704 8652.tmp 1496 86A0.tmp 4308 86FE.tmp 4760 876B.tmp 2108 87C9.tmp 1676 8817.tmp 4460 8865.tmp 1544 88C3.tmp 4996 8911.tmp 3760 896F.tmp 3276 89BD.tmp 4920 8A0B.tmp 3068 8A59.tmp 3612 8AA7.tmp 3660 8AF5.tmp 2940 8B43.tmp 3204 8B91.tmp 3384 8BE0.tmp 2648 8C2E.tmp 1516 8C7C.tmp 2760 8CCA.tmp 1288 8D18.tmp 4172 8D66.tmp 4956 8DF3.tmp 1484 8E41.tmp 3604 8E8F.tmp 1200 8EDD.tmp 2488 8F2B.tmp 4432 8F89.tmp 3140 8FE7.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D046.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A270.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9580.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 623B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6845.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 843E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7286.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8340.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E76D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F509.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 333B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 826A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7882.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4408 wrote to memory of 3004 4408 2026-10-29_0034853a80654704ecaa44a304da5480_elex_mafia_stealc_tofsee.exe 84 PID 3004 wrote to memory of 4664 3004 71A1.tmp 85 PID 4664 wrote to memory of 3308 4664 724D.tmp 86 PID 3308 wrote to memory of 2908 3308 7327.tmp 87 PID 2908 wrote to memory of 1404 2908 73B4.tmp 88 PID 1404 wrote to memory of 816 1404 7450.tmp 89 PID 816 wrote to memory of 1800 816 74FC.tmp 90 PID 1800 wrote to memory of 4680 1800 7589.tmp 91 PID 4680 wrote to memory of 4912 4680 7615.tmp 92 PID 4912 wrote to memory of 4992 4912 76B2.tmp 93 PID 4992 wrote to memory of 1080 4992 772F.tmp 94 PID 1080 wrote to memory of 5064 1080 77BB.tmp 95 PID 5064 wrote to memory of 824 5064 7886.tmp 96 PID 824 wrote to memory of 3716 824 7923.tmp 97 PID 3716 wrote to memory of 5088 3716 79BF.tmp 98 PID 5088 wrote to memory of 4356 5088 7A3C.tmp 99 PID 4356 wrote to memory of 2636 4356 7AC9.tmp 100 PID 2636 wrote to memory of 2464 2636 7B84.tmp 101 PID 2464 wrote to memory of 1232 2464 7C20.tmp 102 PID 1232 wrote to memory of 3104 1232 7CAD.tmp 103 PID 3104 wrote to memory of 5076 3104 7D0B.tmp 104 PID 5076 wrote to memory of 4576 5076 7DC6.tmp 105 PID 4576 wrote to memory of 1252 4576 7E34.tmp 106 PID 1252 wrote to memory of 2448 1252 7EFF.tmp 107 PID 2448 wrote to memory of 1312 2448 7F7C.tmp 108 PID 1312 wrote to memory of 1704 1312 8037.tmp 109 PID 1704 wrote to memory of 4012 1704 80E3.tmp 110 PID 4012 wrote to memory of 1464 4012 81AE.tmp 111 PID 1464 wrote to memory of 3496 1464 826A.tmp 112 PID 3496 wrote to memory of 204 3496 82F6.tmp 113 PID 204 wrote to memory of 4620 204 83A2.tmp 114 PID 4620 wrote to memory of 2168 4620 843E.tmp 115 PID 2168 wrote to memory of 2728 2168 84FA.tmp 116 PID 2728 wrote to memory of 2664 2728 8596.tmp 117 PID 2664 wrote to memory of 4704 2664 85F4.tmp 118 PID 4704 wrote to memory of 1496 4704 8652.tmp 119 PID 1496 wrote to memory of 4308 1496 86A0.tmp 120 PID 4308 wrote to memory of 4760 4308 86FE.tmp 121 PID 4760 wrote to memory of 2108 4760 876B.tmp 122 PID 2108 wrote to memory of 1676 2108 87C9.tmp 123 PID 1676 wrote to memory of 4460 1676 8817.tmp 124 PID 4460 wrote to memory of 1544 4460 8865.tmp 125 PID 1544 wrote to memory of 4996 1544 88C3.tmp 128 PID 4996 wrote to memory of 3760 4996 8911.tmp 129 PID 3760 wrote to memory of 3276 3760 896F.tmp 130 PID 3276 wrote to memory of 4920 3276 89BD.tmp 131 PID 4920 wrote to memory of 3068 4920 8A0B.tmp 132 PID 3068 wrote to memory of 3612 3068 8A59.tmp 133 PID 3612 wrote to memory of 3660 3612 8AA7.tmp 134 PID 3660 wrote to memory of 2940 3660 8AF5.tmp 135 PID 2940 wrote to memory of 3204 2940 8B43.tmp 136 PID 3204 wrote to memory of 3384 3204 8B91.tmp 137 PID 3384 wrote to memory of 2648 3384 8BE0.tmp 138 PID 2648 wrote to memory of 1516 2648 8C2E.tmp 139 PID 1516 wrote to memory of 2760 1516 8C7C.tmp 140 PID 2760 wrote to memory of 1288 2760 8CCA.tmp 141 PID 1288 wrote to memory of 4172 1288 8D18.tmp 143 PID 3560 wrote to memory of 4956 3560 8DB4.tmp 146 PID 4956 wrote to memory of 1484 4956 8DF3.tmp 147 PID 1484 wrote to memory of 3604 1484 8E41.tmp 148 PID 3604 wrote to memory of 1200 3604 8E8F.tmp 149 PID 1200 wrote to memory of 2488 1200 8EDD.tmp 150 PID 2488 wrote to memory of 4432 2488 8F2B.tmp 151 PID 4432 wrote to memory of 3140 4432 8F89.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-29_0034853a80654704ecaa44a304da5480_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-29_0034853a80654704ecaa44a304da5480_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\71A1.tmp"C:\Users\Admin\AppData\Local\Temp\71A1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\724D.tmp"C:\Users\Admin\AppData\Local\Temp\724D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\7327.tmp"C:\Users\Admin\AppData\Local\Temp\7327.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\73B4.tmp"C:\Users\Admin\AppData\Local\Temp\73B4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\7450.tmp"C:\Users\Admin\AppData\Local\Temp\7450.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\74FC.tmp"C:\Users\Admin\AppData\Local\Temp\74FC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\7589.tmp"C:\Users\Admin\AppData\Local\Temp\7589.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\7615.tmp"C:\Users\Admin\AppData\Local\Temp\7615.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\76B2.tmp"C:\Users\Admin\AppData\Local\Temp\76B2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\772F.tmp"C:\Users\Admin\AppData\Local\Temp\772F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\77BB.tmp"C:\Users\Admin\AppData\Local\Temp\77BB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\7886.tmp"C:\Users\Admin\AppData\Local\Temp\7886.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\7923.tmp"C:\Users\Admin\AppData\Local\Temp\7923.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\79BF.tmp"C:\Users\Admin\AppData\Local\Temp\79BF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\7A3C.tmp"C:\Users\Admin\AppData\Local\Temp\7A3C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\7AC9.tmp"C:\Users\Admin\AppData\Local\Temp\7AC9.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\7B84.tmp"C:\Users\Admin\AppData\Local\Temp\7B84.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\7C20.tmp"C:\Users\Admin\AppData\Local\Temp\7C20.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\7CAD.tmp"C:\Users\Admin\AppData\Local\Temp\7CAD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"C:\Users\Admin\AppData\Local\Temp\7D0B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\7DC6.tmp"C:\Users\Admin\AppData\Local\Temp\7DC6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\7E34.tmp"C:\Users\Admin\AppData\Local\Temp\7E34.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"C:\Users\Admin\AppData\Local\Temp\7F7C.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\81AE.tmp"C:\Users\Admin\AppData\Local\Temp\81AE.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\826A.tmp"C:\Users\Admin\AppData\Local\Temp\826A.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\82F6.tmp"C:\Users\Admin\AppData\Local\Temp\82F6.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\83A2.tmp"C:\Users\Admin\AppData\Local\Temp\83A2.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\843E.tmp"C:\Users\Admin\AppData\Local\Temp\843E.tmp"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\84FA.tmp"C:\Users\Admin\AppData\Local\Temp\84FA.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\8596.tmp"C:\Users\Admin\AppData\Local\Temp\8596.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\85F4.tmp"C:\Users\Admin\AppData\Local\Temp\85F4.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\8652.tmp"C:\Users\Admin\AppData\Local\Temp\8652.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\86A0.tmp"C:\Users\Admin\AppData\Local\Temp\86A0.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\86FE.tmp"C:\Users\Admin\AppData\Local\Temp\86FE.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\876B.tmp"C:\Users\Admin\AppData\Local\Temp\876B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\87C9.tmp"C:\Users\Admin\AppData\Local\Temp\87C9.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\8817.tmp"C:\Users\Admin\AppData\Local\Temp\8817.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\8865.tmp"C:\Users\Admin\AppData\Local\Temp\8865.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\88C3.tmp"C:\Users\Admin\AppData\Local\Temp\88C3.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\8911.tmp"C:\Users\Admin\AppData\Local\Temp\8911.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\896F.tmp"C:\Users\Admin\AppData\Local\Temp\896F.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\89BD.tmp"C:\Users\Admin\AppData\Local\Temp\89BD.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"C:\Users\Admin\AppData\Local\Temp\8A0B.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\8A59.tmp"C:\Users\Admin\AppData\Local\Temp\8A59.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\8AA7.tmp"C:\Users\Admin\AppData\Local\Temp\8AA7.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\8AF5.tmp"C:\Users\Admin\AppData\Local\Temp\8AF5.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\8B43.tmp"C:\Users\Admin\AppData\Local\Temp\8B43.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\8B91.tmp"C:\Users\Admin\AppData\Local\Temp\8B91.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"C:\Users\Admin\AppData\Local\Temp\8BE0.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\8C2E.tmp"C:\Users\Admin\AppData\Local\Temp\8C2E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"C:\Users\Admin\AppData\Local\Temp\8C7C.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\8CCA.tmp"C:\Users\Admin\AppData\Local\Temp\8CCA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\8D18.tmp"C:\Users\Admin\AppData\Local\Temp\8D18.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\8D66.tmp"C:\Users\Admin\AppData\Local\Temp\8D66.tmp"58⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\8DB4.tmp"C:\Users\Admin\AppData\Local\Temp\8DB4.tmp"59⤵
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\8DF3.tmp"C:\Users\Admin\AppData\Local\Temp\8DF3.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\8E41.tmp"C:\Users\Admin\AppData\Local\Temp\8E41.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\8E8F.tmp"C:\Users\Admin\AppData\Local\Temp\8E8F.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\8EDD.tmp"C:\Users\Admin\AppData\Local\Temp\8EDD.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\8F2B.tmp"C:\Users\Admin\AppData\Local\Temp\8F2B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\8F89.tmp"C:\Users\Admin\AppData\Local\Temp\8F89.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\8FE7.tmp"C:\Users\Admin\AppData\Local\Temp\8FE7.tmp"66⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\9035.tmp"C:\Users\Admin\AppData\Local\Temp\9035.tmp"67⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\9083.tmp"C:\Users\Admin\AppData\Local\Temp\9083.tmp"68⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\90E1.tmp"C:\Users\Admin\AppData\Local\Temp\90E1.tmp"69⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\912F.tmp"C:\Users\Admin\AppData\Local\Temp\912F.tmp"70⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\917D.tmp"C:\Users\Admin\AppData\Local\Temp\917D.tmp"71⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\91CB.tmp"C:\Users\Admin\AppData\Local\Temp\91CB.tmp"72⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\9219.tmp"C:\Users\Admin\AppData\Local\Temp\9219.tmp"73⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\9267.tmp"C:\Users\Admin\AppData\Local\Temp\9267.tmp"74⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\92B6.tmp"C:\Users\Admin\AppData\Local\Temp\92B6.tmp"75⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\9304.tmp"C:\Users\Admin\AppData\Local\Temp\9304.tmp"76⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\9352.tmp"C:\Users\Admin\AppData\Local\Temp\9352.tmp"77⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\93A0.tmp"C:\Users\Admin\AppData\Local\Temp\93A0.tmp"78⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\93EE.tmp"C:\Users\Admin\AppData\Local\Temp\93EE.tmp"79⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\944C.tmp"C:\Users\Admin\AppData\Local\Temp\944C.tmp"80⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\94AA.tmp"C:\Users\Admin\AppData\Local\Temp\94AA.tmp"81⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\94F8.tmp"C:\Users\Admin\AppData\Local\Temp\94F8.tmp"82⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\9546.tmp"C:\Users\Admin\AppData\Local\Temp\9546.tmp"83⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\9594.tmp"C:\Users\Admin\AppData\Local\Temp\9594.tmp"84⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\9601.tmp"C:\Users\Admin\AppData\Local\Temp\9601.tmp"85⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\964F.tmp"C:\Users\Admin\AppData\Local\Temp\964F.tmp"86⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\969E.tmp"C:\Users\Admin\AppData\Local\Temp\969E.tmp"87⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\96EC.tmp"C:\Users\Admin\AppData\Local\Temp\96EC.tmp"88⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\973A.tmp"C:\Users\Admin\AppData\Local\Temp\973A.tmp"89⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\9798.tmp"C:\Users\Admin\AppData\Local\Temp\9798.tmp"90⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\97E6.tmp"C:\Users\Admin\AppData\Local\Temp\97E6.tmp"91⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\9834.tmp"C:\Users\Admin\AppData\Local\Temp\9834.tmp"92⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\9892.tmp"C:\Users\Admin\AppData\Local\Temp\9892.tmp"93⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\98EF.tmp"C:\Users\Admin\AppData\Local\Temp\98EF.tmp"94⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\993D.tmp"C:\Users\Admin\AppData\Local\Temp\993D.tmp"95⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\998C.tmp"C:\Users\Admin\AppData\Local\Temp\998C.tmp"96⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\99E9.tmp"C:\Users\Admin\AppData\Local\Temp\99E9.tmp"97⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\9A37.tmp"C:\Users\Admin\AppData\Local\Temp\9A37.tmp"98⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\9A95.tmp"C:\Users\Admin\AppData\Local\Temp\9A95.tmp"99⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\9AE3.tmp"C:\Users\Admin\AppData\Local\Temp\9AE3.tmp"100⤵
- System Location Discovery: System Language Discovery
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\9B41.tmp"C:\Users\Admin\AppData\Local\Temp\9B41.tmp"101⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\9B8F.tmp"C:\Users\Admin\AppData\Local\Temp\9B8F.tmp"102⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\9BDD.tmp"C:\Users\Admin\AppData\Local\Temp\9BDD.tmp"103⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\9C2B.tmp"C:\Users\Admin\AppData\Local\Temp\9C2B.tmp"104⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\9C89.tmp"C:\Users\Admin\AppData\Local\Temp\9C89.tmp"105⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\9CD7.tmp"C:\Users\Admin\AppData\Local\Temp\9CD7.tmp"106⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\9D25.tmp"C:\Users\Admin\AppData\Local\Temp\9D25.tmp"107⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\9D74.tmp"C:\Users\Admin\AppData\Local\Temp\9D74.tmp"108⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\9DD1.tmp"C:\Users\Admin\AppData\Local\Temp\9DD1.tmp"109⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\9E1F.tmp"C:\Users\Admin\AppData\Local\Temp\9E1F.tmp"110⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\9E6E.tmp"C:\Users\Admin\AppData\Local\Temp\9E6E.tmp"111⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"C:\Users\Admin\AppData\Local\Temp\9EBC.tmp"112⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\9F0A.tmp"C:\Users\Admin\AppData\Local\Temp\9F0A.tmp"113⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\9F58.tmp"C:\Users\Admin\AppData\Local\Temp\9F58.tmp"114⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\9FA6.tmp"C:\Users\Admin\AppData\Local\Temp\9FA6.tmp"115⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\9FF4.tmp"C:\Users\Admin\AppData\Local\Temp\9FF4.tmp"116⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\A052.tmp"C:\Users\Admin\AppData\Local\Temp\A052.tmp"117⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\A0B0.tmp"C:\Users\Admin\AppData\Local\Temp\A0B0.tmp"118⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\A10D.tmp"C:\Users\Admin\AppData\Local\Temp\A10D.tmp"119⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\A16B.tmp"C:\Users\Admin\AppData\Local\Temp\A16B.tmp"120⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\A1D9.tmp"C:\Users\Admin\AppData\Local\Temp\A1D9.tmp"121⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\A236.tmp"C:\Users\Admin\AppData\Local\Temp\A236.tmp"122⤵PID:2332
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-