Analysis
- max time kernel
150s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 13:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-01_9be08b874dd2afd182c5f0ed7964f9b6_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_9be08b874dd2afd182c5f0ed7964f9b6_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-11-01_9be08b874dd2afd182c5f0ed7964f9b6_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample261102-q1ycsstyhv
- SHA256 b9397048d3c28668bd02ba926004ebe8b45c8c642dfe549067ae6602105367ca
- MD5 9be08b874dd2afd182c5f0ed7964f9b6
- SHA1 d6c430c1f4b9bb229bb3ef9f7faf9a2439c8678b
- SHA512 47d257ea2c0a2334c8338097e1bda3a93c551c3b29ccce9d4d7f992a00bb582b59a421a95d9c37724bbb9e92698ba6142433a6cb9254b256ec239a759f2c0ce4
- SSDEEP 12288:yU5rCOTeiNqLTKcUuDJBQo3WZhzPpqbZ:yUQOJNqLdUunQtzPpqb
- TLSH T105B4F121B985C032F69606304EE6EBB1293B3C715B26A4C76B90776E6FB12D2D774307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 376 BD21.tmp 4876 BDCD.tmp 908 BE88.tmp 2836 BF63.tmp 4248 BFE0.tmp 2452 C06D.tmp 3040 C119.tmp 2284 C1C4.tmp 4400 C241.tmp 1016 C2CE.tmp 940 C33B.tmp 3772 C3D8.tmp 4544 C484.tmp 4232 C520.tmp 5116 C5DB.tmp 4644 C687.tmp 4048 C723.tmp 800 C7B0.tmp 4176 C84C.tmp 2784 C8C9.tmp 5004 C956.tmp 4032 CA11.tmp 5036 CAAE.tmp 220 CB4A.tmp 4888 CBE6.tmp 948 CC54.tmp 2928 CCF0.tmp 1404 CD4E.tmp 3092 CE09.tmp 2316 CEB5.tmp 4776 CF61.tmp 3272 CFBF.tmp 3120 D06A.tmp 3956 D0B9.tmp 2024 D107.tmp 2652 D164.tmp 1264 D1C2.tmp 4948 D210.tmp 3884 D25E.tmp 876 D2AD.tmp 3796 D2FB.tmp 3544 D349.tmp 5076 D397.tmp 3284 D3E5.tmp 2136 D433.tmp 2736 D491.tmp 4184 D4DF.tmp 2720 D52D.tmp 2612 D57B.tmp 3240 D5C9.tmp 764 D618.tmp 3264 D666.tmp 892 D6B4.tmp 3416 D702.tmp 4616 D750.tmp 2868 D7AE.tmp 4236 D7FC.tmp 4348 D84A.tmp 2412 D898.tmp 3972 D8F6.tmp 3220 D954.tmp 3804 D9A2.tmp 4620 DA00.tmp 4724 DA5D.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 161E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4982.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4675.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A147.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6027.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C440.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B98.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6690.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3752.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 570F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2358.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E104.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1275.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5579.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8042.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5625.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B26E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D095.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3109.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5048 wrote to memory of 376 5048 2026-11-01_9be08b874dd2afd182c5f0ed7964f9b6_elex_mafia_stealc_tofsee.exe 84 PID 376 wrote to memory of 4876 376 BD21.tmp 85 PID 4876 wrote to memory of 908 4876 BDCD.tmp 86 PID 908 wrote to memory of 2836 908 BE88.tmp 87 PID 2836 wrote to memory of 4248 2836 BF63.tmp 88 PID 4248 wrote to memory of 2452 4248 BFE0.tmp 89 PID 2452 wrote to memory of 3040 2452 C06D.tmp 90 PID 3040 wrote to memory of 2284 3040 C119.tmp 91 PID 2284 wrote to memory of 4400 2284 C1C4.tmp 92 PID 4400 wrote to memory of 1016 4400 C241.tmp 93 PID 1016 wrote to memory of 940 1016 C2CE.tmp 94 PID 940 wrote to memory of 3772 940 C33B.tmp 95 PID 3772 wrote to memory of 4544 3772 C3D8.tmp 96 PID 4544 wrote to memory of 4232 4544 C484.tmp 97 PID 4232 wrote to memory of 5116 4232 C520.tmp 98 PID 5116 wrote to memory of 4644 5116 C5DB.tmp 99 PID 4644 wrote to memory of 4048 4644 C687.tmp 100 PID 4048 wrote to memory of 800 4048 C723.tmp 101 PID 800 wrote to memory of 4176 800 C7B0.tmp 102 PID 4176 wrote to memory of 2784 4176 C84C.tmp 103 PID 2784 wrote to memory of 5004 2784 C8C9.tmp 104 PID 5004 wrote to memory of 4032 5004 C956.tmp 105 PID 4032 wrote to memory of 5036 4032 CA11.tmp 106 PID 5036 wrote to memory of 220 5036 CAAE.tmp 107 PID 220 wrote to memory of 4888 220 CB4A.tmp 108 PID 4888 wrote to memory of 948 4888 CBE6.tmp 109 PID 948 wrote to memory of 2928 948 CC54.tmp 110 PID 2928 wrote to memory of 1404 2928 CCF0.tmp 111 PID 1404 wrote to memory of 3092 1404 CD4E.tmp 114 PID 3092 wrote to memory of 2316 3092 CE09.tmp 115 PID 2316 wrote to memory of 4776 2316 CEB5.tmp 116 PID 4776 wrote to memory of 3272 4776 CF61.tmp 117 PID 3272 wrote to memory of 3120 3272 CFBF.tmp 118 PID 3120 wrote to memory of 3956 3120 D06A.tmp 119 PID 3956 wrote to memory of 2024 3956 D0B9.tmp 120 PID 2024 wrote to memory of 2652 2024 D107.tmp 121 PID 2652 wrote to memory of 1264 2652 D164.tmp 122 PID 1264 wrote to memory of 4948 1264 D1C2.tmp 124 PID 4948 wrote to memory of 3884 4948 D210.tmp 126 PID 3884 wrote to memory of 876 3884 D25E.tmp 127 PID 876 wrote to memory of 3796 876 D2AD.tmp 128 PID 3796 wrote to memory of 3544 3796 D2FB.tmp 129 PID 3544 wrote to memory of 5076 3544 D349.tmp 130 PID 5076 wrote to memory of 3284 5076 D397.tmp 131 PID 3284 wrote to memory of 2136 3284 D3E5.tmp 132 PID 2136 wrote to memory of 2736 2136 D433.tmp 133 PID 2736 wrote to memory of 4184 2736 D491.tmp 134 PID 4184 wrote to memory of 2720 4184 D4DF.tmp 135 PID 2720 wrote to memory of 2612 2720 D52D.tmp 136 PID 2612 wrote to memory of 3240 2612 D57B.tmp 137 PID 3240 wrote to memory of 764 3240 D5C9.tmp 138 PID 764 wrote to memory of 3264 764 D618.tmp 139 PID 3264 wrote to memory of 892 3264 D666.tmp 140 PID 892 wrote to memory of 3416 892 D6B4.tmp 141 PID 3416 wrote to memory of 4616 3416 D702.tmp 142 PID 4616 wrote to memory of 2868 4616 D750.tmp 143 PID 2868 wrote to memory of 4236 2868 D7AE.tmp 144 PID 4236 wrote to memory of 4348 4236 D7FC.tmp 145 PID 4348 wrote to memory of 2412 4348 D84A.tmp 146 PID 2412 wrote to memory of 3972 2412 D898.tmp 147 PID 3972 wrote to memory of 3220 3972 D8F6.tmp 148 PID 3220 wrote to memory of 3804 3220 D954.tmp 149 PID 3804 wrote to memory of 4620 3804 D9A2.tmp 150 PID 4620 wrote to memory of 4724 4620 DA00.tmp 151
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_9be08b874dd2afd182c5f0ed7964f9b6_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_9be08b874dd2afd182c5f0ed7964f9b6_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\BD21.tmp"C:\Users\Admin\AppData\Local\Temp\BD21.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\BDCD.tmp"C:\Users\Admin\AppData\Local\Temp\BDCD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\BE88.tmp"C:\Users\Admin\AppData\Local\Temp\BE88.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Users\Admin\AppData\Local\Temp\BF63.tmp"C:\Users\Admin\AppData\Local\Temp\BF63.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\BFE0.tmp"C:\Users\Admin\AppData\Local\Temp\BFE0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\C06D.tmp"C:\Users\Admin\AppData\Local\Temp\C06D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\C119.tmp"C:\Users\Admin\AppData\Local\Temp\C119.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\C241.tmp"C:\Users\Admin\AppData\Local\Temp\C241.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\C2CE.tmp"C:\Users\Admin\AppData\Local\Temp\C2CE.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\C33B.tmp"C:\Users\Admin\AppData\Local\Temp\C33B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\C3D8.tmp"C:\Users\Admin\AppData\Local\Temp\C3D8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\C484.tmp"C:\Users\Admin\AppData\Local\Temp\C484.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\C520.tmp"C:\Users\Admin\AppData\Local\Temp\C520.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\C5DB.tmp"C:\Users\Admin\AppData\Local\Temp\C5DB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\C687.tmp"C:\Users\Admin\AppData\Local\Temp\C687.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\C723.tmp"C:\Users\Admin\AppData\Local\Temp\C723.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\C84C.tmp"C:\Users\Admin\AppData\Local\Temp\C84C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\C8C9.tmp"C:\Users\Admin\AppData\Local\Temp\C8C9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\C956.tmp"C:\Users\Admin\AppData\Local\Temp\C956.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\CA11.tmp"C:\Users\Admin\AppData\Local\Temp\CA11.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\CAAE.tmp"C:\Users\Admin\AppData\Local\Temp\CAAE.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\CC54.tmp"C:\Users\Admin\AppData\Local\Temp\CC54.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\CD4E.tmp"C:\Users\Admin\AppData\Local\Temp\CD4E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\CEB5.tmp"C:\Users\Admin\AppData\Local\Temp\CEB5.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\CF61.tmp"C:\Users\Admin\AppData\Local\Temp\CF61.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\D06A.tmp"C:\Users\Admin\AppData\Local\Temp\D06A.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\D0B9.tmp"C:\Users\Admin\AppData\Local\Temp\D0B9.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\D107.tmp"C:\Users\Admin\AppData\Local\Temp\D107.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\D164.tmp"C:\Users\Admin\AppData\Local\Temp\D164.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\D1C2.tmp"C:\Users\Admin\AppData\Local\Temp\D1C2.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\D210.tmp"C:\Users\Admin\AppData\Local\Temp\D210.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\D25E.tmp"C:\Users\Admin\AppData\Local\Temp\D25E.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\D2AD.tmp"C:\Users\Admin\AppData\Local\Temp\D2AD.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\D2FB.tmp"C:\Users\Admin\AppData\Local\Temp\D2FB.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\D349.tmp"C:\Users\Admin\AppData\Local\Temp\D349.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\D397.tmp"C:\Users\Admin\AppData\Local\Temp\D397.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\D3E5.tmp"C:\Users\Admin\AppData\Local\Temp\D3E5.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\D433.tmp"C:\Users\Admin\AppData\Local\Temp\D433.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\D491.tmp"C:\Users\Admin\AppData\Local\Temp\D491.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\D4DF.tmp"C:\Users\Admin\AppData\Local\Temp\D4DF.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\D52D.tmp"C:\Users\Admin\AppData\Local\Temp\D52D.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\D57B.tmp"C:\Users\Admin\AppData\Local\Temp\D57B.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\D5C9.tmp"C:\Users\Admin\AppData\Local\Temp\D5C9.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\D618.tmp"C:\Users\Admin\AppData\Local\Temp\D618.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\D666.tmp"C:\Users\Admin\AppData\Local\Temp\D666.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\D6B4.tmp"C:\Users\Admin\AppData\Local\Temp\D6B4.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\D702.tmp"C:\Users\Admin\AppData\Local\Temp\D702.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\D750.tmp"C:\Users\Admin\AppData\Local\Temp\D750.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\D7AE.tmp"C:\Users\Admin\AppData\Local\Temp\D7AE.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\D7FC.tmp"C:\Users\Admin\AppData\Local\Temp\D7FC.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\D84A.tmp"C:\Users\Admin\AppData\Local\Temp\D84A.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\D898.tmp"C:\Users\Admin\AppData\Local\Temp\D898.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\D8F6.tmp"C:\Users\Admin\AppData\Local\Temp\D8F6.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\D954.tmp"C:\Users\Admin\AppData\Local\Temp\D954.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\D9A2.tmp"C:\Users\Admin\AppData\Local\Temp\D9A2.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\DA00.tmp"C:\Users\Admin\AppData\Local\Temp\DA00.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\DA5D.tmp"C:\Users\Admin\AppData\Local\Temp\DA5D.tmp"65⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\DAAB.tmp"C:\Users\Admin\AppData\Local\Temp\DAAB.tmp"66⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\DB19.tmp"C:\Users\Admin\AppData\Local\Temp\DB19.tmp"67⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\DB67.tmp"C:\Users\Admin\AppData\Local\Temp\DB67.tmp"68⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"C:\Users\Admin\AppData\Local\Temp\DBB5.tmp"69⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\DC13.tmp"C:\Users\Admin\AppData\Local\Temp\DC13.tmp"70⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\DC80.tmp"C:\Users\Admin\AppData\Local\Temp\DC80.tmp"71⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\DCCE.tmp"C:\Users\Admin\AppData\Local\Temp\DCCE.tmp"72⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"C:\Users\Admin\AppData\Local\Temp\DD2C.tmp"73⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"C:\Users\Admin\AppData\Local\Temp\DD7A.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\DDC8.tmp"C:\Users\Admin\AppData\Local\Temp\DDC8.tmp"75⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\DE16.tmp"C:\Users\Admin\AppData\Local\Temp\DE16.tmp"76⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\DE65.tmp"C:\Users\Admin\AppData\Local\Temp\DE65.tmp"77⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\DEC2.tmp"C:\Users\Admin\AppData\Local\Temp\DEC2.tmp"78⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\DF20.tmp"C:\Users\Admin\AppData\Local\Temp\DF20.tmp"79⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\DF6E.tmp"C:\Users\Admin\AppData\Local\Temp\DF6E.tmp"80⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\DFBC.tmp"C:\Users\Admin\AppData\Local\Temp\DFBC.tmp"81⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\E01A.tmp"C:\Users\Admin\AppData\Local\Temp\E01A.tmp"82⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\E068.tmp"C:\Users\Admin\AppData\Local\Temp\E068.tmp"83⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\E0B6.tmp"C:\Users\Admin\AppData\Local\Temp\E0B6.tmp"84⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\E104.tmp"C:\Users\Admin\AppData\Local\Temp\E104.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\E172.tmp"C:\Users\Admin\AppData\Local\Temp\E172.tmp"86⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\E1D0.tmp"C:\Users\Admin\AppData\Local\Temp\E1D0.tmp"87⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\E23D.tmp"C:\Users\Admin\AppData\Local\Temp\E23D.tmp"88⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\E28B.tmp"C:\Users\Admin\AppData\Local\Temp\E28B.tmp"89⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\E2D9.tmp"C:\Users\Admin\AppData\Local\Temp\E2D9.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\E337.tmp"C:\Users\Admin\AppData\Local\Temp\E337.tmp"91⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\E395.tmp"C:\Users\Admin\AppData\Local\Temp\E395.tmp"92⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\E402.tmp"C:\Users\Admin\AppData\Local\Temp\E402.tmp"93⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\E46F.tmp"C:\Users\Admin\AppData\Local\Temp\E46F.tmp"94⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\E4BE.tmp"C:\Users\Admin\AppData\Local\Temp\E4BE.tmp"95⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\E50C.tmp"C:\Users\Admin\AppData\Local\Temp\E50C.tmp"96⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\E55A.tmp"C:\Users\Admin\AppData\Local\Temp\E55A.tmp"97⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\E5B8.tmp"C:\Users\Admin\AppData\Local\Temp\E5B8.tmp"98⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\E606.tmp"C:\Users\Admin\AppData\Local\Temp\E606.tmp"99⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\E654.tmp"C:\Users\Admin\AppData\Local\Temp\E654.tmp"100⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\E6A2.tmp"C:\Users\Admin\AppData\Local\Temp\E6A2.tmp"101⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\E6F0.tmp"C:\Users\Admin\AppData\Local\Temp\E6F0.tmp"102⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\E73E.tmp"C:\Users\Admin\AppData\Local\Temp\E73E.tmp"103⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"C:\Users\Admin\AppData\Local\Temp\E7AC.tmp"104⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\E809.tmp"C:\Users\Admin\AppData\Local\Temp\E809.tmp"105⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\E857.tmp"C:\Users\Admin\AppData\Local\Temp\E857.tmp"106⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\E8A6.tmp"C:\Users\Admin\AppData\Local\Temp\E8A6.tmp"107⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\E8F4.tmp"C:\Users\Admin\AppData\Local\Temp\E8F4.tmp"108⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\E942.tmp"C:\Users\Admin\AppData\Local\Temp\E942.tmp"109⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\E9AF.tmp"C:\Users\Admin\AppData\Local\Temp\E9AF.tmp"110⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\E9FD.tmp"C:\Users\Admin\AppData\Local\Temp\E9FD.tmp"111⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\EA5B.tmp"C:\Users\Admin\AppData\Local\Temp\EA5B.tmp"112⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\EAB9.tmp"C:\Users\Admin\AppData\Local\Temp\EAB9.tmp"113⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\EB07.tmp"C:\Users\Admin\AppData\Local\Temp\EB07.tmp"114⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\EB65.tmp"C:\Users\Admin\AppData\Local\Temp\EB65.tmp"115⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\EBC2.tmp"C:\Users\Admin\AppData\Local\Temp\EBC2.tmp"116⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\EC11.tmp"C:\Users\Admin\AppData\Local\Temp\EC11.tmp"117⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"C:\Users\Admin\AppData\Local\Temp\EC6E.tmp"118⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\ECCC.tmp"C:\Users\Admin\AppData\Local\Temp\ECCC.tmp"119⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\ED1A.tmp"C:\Users\Admin\AppData\Local\Temp\ED1A.tmp"120⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\ED88.tmp"C:\Users\Admin\AppData\Local\Temp\ED88.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\EDD6.tmp"C:\Users\Admin\AppData\Local\Temp\EDD6.tmp"122⤵PID:1700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-