Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/04/2026, 16:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-22_00c9ebc7bdbaf85cf4cd008b1b7cb775_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-22_00c9ebc7bdbaf85cf4cd008b1b7cb775_elex_mafia_stealc_tofsee.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-04-22_00c9ebc7bdbaf85cf4cd008b1b7cb775_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260422-tkdv1aaz5p
- SHA256 b86d8ce4ee79f3dc461850b1b18558ed14c2710c96f30609e4feedece3cf0836
- MD5 00c9ebc7bdbaf85cf4cd008b1b7cb775
- SHA1 cd9c2532542bdb7950c7ad56f1e373a89b8d0237
- SHA512 ea66958cb2b6cbe11b9c20de9eb9052021a3d9b2d1373a5670a93d683d0a0aae27900bbc9776aac32e3f196680ca86eea7dd311619f743f804cf299d2e93cf17
- SSDEEP 12288:NU5rCOTeij4GpwpSOelElddPucTZwlH4Hp:NUQOJj7pwMlMddbTSlH4Hp
- TLSH T1A6B4E126B644C132E6C302710ED6EBE12A3B7C35672A95C33B94A23E2F756E1D375346
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4308 E34B.tmp 4564 E3F7.tmp 4396 E474.tmp 4676 E501.tmp 2224 E58D.tmp 6008 E62A.tmp 4744 E6E5.tmp 4484 E781.tmp 3716 E80E.tmp 5300 E8AA.tmp 4588 E908.tmp 2620 E9C4.tmp 4684 EA60.tmp 5888 EB1B.tmp 2912 EBD7.tmp 1444 EC83.tmp 3540 ED1F.tmp 4452 EDBB.tmp 4632 EE57.tmp 5344 EF23.tmp 1760 EFBF.tmp 364 F04B.tmp 60 F0B9.tmp 4020 F174.tmp 2624 F201.tmp 2616 F29D.tmp 1616 F349.tmp 5284 F3F5.tmp 5528 F482.tmp 4992 F52D.tmp 960 F5BA.tmp 4776 F647.tmp 5564 F6E3.tmp 380 F760.tmp 1800 F7AE.tmp 4176 F7FC.tmp 2832 F84A.tmp 1640 F898.tmp 5796 F8E7.tmp 5280 F944.tmp 5992 F9B2.tmp 3228 FA00.tmp 3468 FA4E.tmp 3060 FA9C.tmp 3336 FAFA.tmp 3304 FB48.tmp 4172 FBB5.tmp 3876 FC03.tmp 3224 FC52.tmp 688 FCBF.tmp 5976 FD0D.tmp 5364 FD6B.tmp 1072 FDB9.tmp 3580 FE17.tmp 1152 FE65.tmp 1868 FED2.tmp 5904 FF40.tmp 3756 FFAD.tmp 2880 FFFB.tmp 3892 59.tmp 5452 D6.tmp 1816 124.tmp 5728 1A1.tmp 956 20E.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 194F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B428.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3138.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 849C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1052.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1008.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C455.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 433E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B91A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C280.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C985.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C501.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 575.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4380 wrote to memory of 4308 4380 2026-04-22_00c9ebc7bdbaf85cf4cd008b1b7cb775_elex_mafia_stealc_tofsee.exe 83 PID 4308 wrote to memory of 4564 4308 E34B.tmp 84 PID 4564 wrote to memory of 4396 4564 E3F7.tmp 85 PID 4396 wrote to memory of 4676 4396 E474.tmp 86 PID 4676 wrote to memory of 2224 4676 E501.tmp 87 PID 2224 wrote to memory of 6008 2224 E58D.tmp 88 PID 6008 wrote to memory of 4744 6008 E62A.tmp 89 PID 4744 wrote to memory of 4484 4744 E6E5.tmp 90 PID 4484 wrote to memory of 3716 4484 E781.tmp 91 PID 3716 wrote to memory of 5300 3716 E80E.tmp 92 PID 5300 wrote to memory of 4588 5300 E8AA.tmp 93 PID 4588 wrote to memory of 2620 4588 E908.tmp 94 PID 2620 wrote to memory of 4684 2620 E9C4.tmp 95 PID 4684 wrote to memory of 5888 4684 EA60.tmp 96 PID 5888 wrote to memory of 2912 5888 EB1B.tmp 97 PID 2912 wrote to memory of 1444 2912 EBD7.tmp 98 PID 1444 wrote to memory of 3540 1444 EC83.tmp 99 PID 3540 wrote to memory of 4452 3540 ED1F.tmp 100 PID 4452 wrote to memory of 4632 4452 EDBB.tmp 101 PID 4632 wrote to memory of 5344 4632 EE57.tmp 102 PID 5344 wrote to memory of 1760 5344 EF23.tmp 103 PID 1760 wrote to memory of 364 1760 EFBF.tmp 104 PID 364 wrote to memory of 60 364 F04B.tmp 105 PID 60 wrote to memory of 4020 60 F0B9.tmp 106 PID 4020 wrote to memory of 2624 4020 F174.tmp 107 PID 2624 wrote to memory of 2616 2624 F201.tmp 108 PID 2616 wrote to memory of 1616 2616 F29D.tmp 109 PID 1616 wrote to memory of 5284 1616 F349.tmp 110 PID 5284 wrote to memory of 5528 5284 F3F5.tmp 111 PID 5528 wrote to memory of 4992 5528 F482.tmp 112 PID 4992 wrote to memory of 960 4992 F52D.tmp 113 PID 960 wrote to memory of 4776 960 F5BA.tmp 114 PID 4776 wrote to memory of 5564 4776 F647.tmp 115 PID 5564 wrote to memory of 380 5564 F6E3.tmp 116 PID 380 wrote to memory of 1800 380 F760.tmp 117 PID 1800 wrote to memory of 4176 1800 F7AE.tmp 118 PID 4176 wrote to memory of 2832 4176 F7FC.tmp 119 PID 2832 wrote to memory of 1640 2832 F84A.tmp 120 PID 1640 wrote to memory of 5796 1640 F898.tmp 121 PID 5796 wrote to memory of 5280 5796 F8E7.tmp 122 PID 5280 wrote to memory of 5992 5280 F944.tmp 123 PID 5992 wrote to memory of 3228 5992 F9B2.tmp 124 PID 3228 wrote to memory of 3468 3228 FA00.tmp 125 PID 3468 wrote to memory of 3060 3468 FA4E.tmp 126 PID 3060 wrote to memory of 3336 3060 FA9C.tmp 127 PID 3336 wrote to memory of 3304 3336 FAFA.tmp 128 PID 3304 wrote to memory of 4172 3304 FB48.tmp 129 PID 4172 wrote to memory of 3876 4172 FBB5.tmp 130 PID 3876 wrote to memory of 3224 3876 FC03.tmp 131 PID 3224 wrote to memory of 688 3224 FC52.tmp 132 PID 688 wrote to memory of 5976 688 FCBF.tmp 133 PID 5976 wrote to memory of 5364 5976 FD0D.tmp 134 PID 5364 wrote to memory of 1072 5364 FD6B.tmp 135 PID 1072 wrote to memory of 3580 1072 FDB9.tmp 136 PID 3580 wrote to memory of 1152 3580 FE17.tmp 137 PID 1152 wrote to memory of 1868 1152 FE65.tmp 138 PID 1868 wrote to memory of 5904 1868 FED2.tmp 139 PID 5904 wrote to memory of 3756 5904 FF40.tmp 140 PID 3756 wrote to memory of 2880 3756 FFAD.tmp 141 PID 2880 wrote to memory of 3892 2880 FFFB.tmp 142 PID 3892 wrote to memory of 5452 3892 59.tmp 143 PID 5452 wrote to memory of 1816 5452 D6.tmp 144 PID 1816 wrote to memory of 5728 1816 124.tmp 145 PID 5728 wrote to memory of 956 5728 1A1.tmp 146
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_00c9ebc7bdbaf85cf4cd008b1b7cb775_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_00c9ebc7bdbaf85cf4cd008b1b7cb775_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\E34B.tmp"C:\Users\Admin\AppData\Local\Temp\E34B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\E474.tmp"C:\Users\Admin\AppData\Local\Temp\E474.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\E58D.tmp"C:\Users\Admin\AppData\Local\Temp\E58D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\E62A.tmp"C:\Users\Admin\AppData\Local\Temp\E62A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"C:\Users\Admin\AppData\Local\Temp\E6E5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\E781.tmp"C:\Users\Admin\AppData\Local\Temp\E781.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\EA60.tmp"C:\Users\Admin\AppData\Local\Temp\EA60.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"C:\Users\Admin\AppData\Local\Temp\EB1B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\EC83.tmp"C:\Users\Admin\AppData\Local\Temp\EC83.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\EE57.tmp"C:\Users\Admin\AppData\Local\Temp\EE57.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\EF23.tmp"C:\Users\Admin\AppData\Local\Temp\EF23.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\F04B.tmp"C:\Users\Admin\AppData\Local\Temp\F04B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"C:\Users\Admin\AppData\Local\Temp\F0B9.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\F201.tmp"C:\Users\Admin\AppData\Local\Temp\F201.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\F29D.tmp"C:\Users\Admin\AppData\Local\Temp\F29D.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\F349.tmp"C:\Users\Admin\AppData\Local\Temp\F349.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\F3F5.tmp"C:\Users\Admin\AppData\Local\Temp\F3F5.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\F482.tmp"C:\Users\Admin\AppData\Local\Temp\F482.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5528 -
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"C:\Users\Admin\AppData\Local\Temp\F5BA.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\F647.tmp"C:\Users\Admin\AppData\Local\Temp\F647.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\F760.tmp"C:\Users\Admin\AppData\Local\Temp\F760.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"C:\Users\Admin\AppData\Local\Temp\F7FC.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\F84A.tmp"C:\Users\Admin\AppData\Local\Temp\F84A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"C:\Users\Admin\AppData\Local\Temp\F8E7.tmp"40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5796 -
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5992 -
C:\Users\Admin\AppData\Local\Temp\FA00.tmp"C:\Users\Admin\AppData\Local\Temp\FA00.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"C:\Users\Admin\AppData\Local\Temp\FA9C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\FB48.tmp"C:\Users\Admin\AppData\Local\Temp\FB48.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\FC03.tmp"C:\Users\Admin\AppData\Local\Temp\FC03.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\FC52.tmp"C:\Users\Admin\AppData\Local\Temp\FC52.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"C:\Users\Admin\AppData\Local\Temp\FD0D.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"C:\Users\Admin\AppData\Local\Temp\FD6B.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\FE17.tmp"C:\Users\Admin\AppData\Local\Temp\FE17.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\FE65.tmp"C:\Users\Admin\AppData\Local\Temp\FE65.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\FED2.tmp"C:\Users\Admin\AppData\Local\Temp\FED2.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\FF40.tmp"C:\Users\Admin\AppData\Local\Temp\FF40.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"C:\Users\Admin\AppData\Local\Temp\FFAD.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"C:\Users\Admin\AppData\Local\Temp\FFFB.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\59.tmp"C:\Users\Admin\AppData\Local\Temp\59.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\D6.tmp"C:\Users\Admin\AppData\Local\Temp\D6.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\124.tmp"C:\Users\Admin\AppData\Local\Temp\124.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\1A1.tmp"C:\Users\Admin\AppData\Local\Temp\1A1.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\20E.tmp"C:\Users\Admin\AppData\Local\Temp\20E.tmp"65⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"66⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\2CA.tmp"C:\Users\Admin\AppData\Local\Temp\2CA.tmp"67⤵PID:5792
-
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"68⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\385.tmp"C:\Users\Admin\AppData\Local\Temp\385.tmp"69⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\3E3.tmp"C:\Users\Admin\AppData\Local\Temp\3E3.tmp"70⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"71⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\49F.tmp"C:\Users\Admin\AppData\Local\Temp\49F.tmp"72⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\50C.tmp"C:\Users\Admin\AppData\Local\Temp\50C.tmp"73⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\55A.tmp"C:\Users\Admin\AppData\Local\Temp\55A.tmp"74⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\5B8.tmp"C:\Users\Admin\AppData\Local\Temp\5B8.tmp"75⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\606.tmp"C:\Users\Admin\AppData\Local\Temp\606.tmp"76⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\673.tmp"C:\Users\Admin\AppData\Local\Temp\673.tmp"77⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\6D1.tmp"C:\Users\Admin\AppData\Local\Temp\6D1.tmp"78⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\73E.tmp"C:\Users\Admin\AppData\Local\Temp\73E.tmp"79⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"80⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\80A.tmp"C:\Users\Admin\AppData\Local\Temp\80A.tmp"81⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\858.tmp"C:\Users\Admin\AppData\Local\Temp\858.tmp"82⤵PID:5180
-
C:\Users\Admin\AppData\Local\Temp\8C5.tmp"C:\Users\Admin\AppData\Local\Temp\8C5.tmp"83⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"84⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\981.tmp"C:\Users\Admin\AppData\Local\Temp\981.tmp"85⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\9CF.tmp"C:\Users\Admin\AppData\Local\Temp\9CF.tmp"86⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\A2C.tmp"C:\Users\Admin\AppData\Local\Temp\A2C.tmp"87⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"88⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"89⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\B26.tmp"C:\Users\Admin\AppData\Local\Temp\B26.tmp"90⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\B75.tmp"C:\Users\Admin\AppData\Local\Temp\B75.tmp"91⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\BD2.tmp"C:\Users\Admin\AppData\Local\Temp\BD2.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\C20.tmp"C:\Users\Admin\AppData\Local\Temp\C20.tmp"93⤵PID:5380
-
C:\Users\Admin\AppData\Local\Temp\C7E.tmp"C:\Users\Admin\AppData\Local\Temp\C7E.tmp"94⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\CCC.tmp"C:\Users\Admin\AppData\Local\Temp\CCC.tmp"95⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\D1A.tmp"C:\Users\Admin\AppData\Local\Temp\D1A.tmp"96⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"97⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"98⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"99⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"100⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"101⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\F2E.tmp"C:\Users\Admin\AppData\Local\Temp\F2E.tmp"102⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"103⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\1066.tmp"C:\Users\Admin\AppData\Local\Temp\1066.tmp"105⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\10B4.tmp"C:\Users\Admin\AppData\Local\Temp\10B4.tmp"106⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\1131.tmp"C:\Users\Admin\AppData\Local\Temp\1131.tmp"107⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\117F.tmp"C:\Users\Admin\AppData\Local\Temp\117F.tmp"108⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\11DD.tmp"C:\Users\Admin\AppData\Local\Temp\11DD.tmp"109⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\123B.tmp"C:\Users\Admin\AppData\Local\Temp\123B.tmp"110⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\1289.tmp"C:\Users\Admin\AppData\Local\Temp\1289.tmp"111⤵PID:5900
-
C:\Users\Admin\AppData\Local\Temp\12F6.tmp"C:\Users\Admin\AppData\Local\Temp\12F6.tmp"112⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\1345.tmp"C:\Users\Admin\AppData\Local\Temp\1345.tmp"113⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\13A2.tmp"C:\Users\Admin\AppData\Local\Temp\13A2.tmp"114⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\13F0.tmp"C:\Users\Admin\AppData\Local\Temp\13F0.tmp"115⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"116⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\149C.tmp"C:\Users\Admin\AppData\Local\Temp\149C.tmp"117⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"118⤵PID:5656
-
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"119⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\15B6.tmp"C:\Users\Admin\AppData\Local\Temp\15B6.tmp"120⤵PID:5336
-
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"121⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"122⤵PID:5332
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-