Analysis
- max time kernel
150s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/05/2026, 22:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-05_520d343148b7344b1dac0a4eac3ee00f_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-05_520d343148b7344b1dac0a4eac3ee00f_elex_mafia_stealc_tofsee.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-05-05_520d343148b7344b1dac0a4eac3ee00f_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260505-2nx22sf14y
- SHA256 d1cc838ce1c0dd976da379e2cdfea0935e55ec8655f1c2a6bbc9cab323110187
- MD5 520d343148b7344b1dac0a4eac3ee00f
- SHA1 7f906e2ca5429d03bc52bae699f303c0015f2129
- SHA512 a403c17494d1511a63c2cf199fd5bc533c1d7746a03433d248205ebbecafc178195b0c9b5ca4f6daee314088609f33aff52ddc168045134700f36b00abde9490
- SSDEEP 12288:NU5rCOTeijDKATgjne5QrG080LyTZwlH:NUQOJjDKAT8neKLLyTSlH
- TLSH T115B4F1257584C132E69202710AE2EBF15A3FBC315B2654C76B88637E2FB57E1E379306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4116 990.tmp 4364 A5B.tmp 1700 B17.tmp 748 BD2.tmp 1444 C5F.tmp 3848 CEC.tmp 2796 D69.tmp 3324 E24.tmp 5076 EC0.tmp 4512 F6C.tmp 4808 1037.tmp 4896 1122.tmp 1944 11AE.tmp 852 1289.tmp 2312 1306.tmp 2320 13B2.tmp 3728 146D.tmp 2480 14EA.tmp 1148 1577.tmp 3768 1604.tmp 2100 16A0.tmp 1368 175B.tmp 3284 17C9.tmp 2932 1884.tmp 4180 1901.tmp 4220 199E.tmp 4764 1A3A.tmp 4516 1AC6.tmp 1692 1B34.tmp 224 1BEF.tmp 3268 1CAB.tmp 1688 1D47.tmp 4704 1DE3.tmp 3388 1E41.tmp 2272 1EAE.tmp 3460 1EFD.tmp 3900 1F4B.tmp 4196 1F99.tmp 3816 1FF7.tmp 1812 2045.tmp 3280 2093.tmp 2244 20E1.tmp 4840 214E.tmp 1844 219C.tmp 412 21FA.tmp 2852 2248.tmp 3400 2296.tmp 2228 22E5.tmp 4036 2342.tmp 2896 2390.tmp 4428 23EE.tmp 1548 243C.tmp 3504 248A.tmp 4200 24D9.tmp 1472 2527.tmp 3060 2584.tmp 4312 25E2.tmp 1172 2650.tmp 2776 26CD.tmp 3048 273A.tmp 4348 2788.tmp 768 27D6.tmp 3524 2834.tmp 2904 2882.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3767.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 405F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3733.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 530D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 582D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E942.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7805.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 390C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D712.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 919C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA06.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FA4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1294.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2418.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1037.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 570F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 695F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 784 wrote to memory of 4116 784 2026-05-05_520d343148b7344b1dac0a4eac3ee00f_elex_mafia_stealc_tofsee.exe 85 PID 4116 wrote to memory of 4364 4116 990.tmp 86 PID 4364 wrote to memory of 1700 4364 A5B.tmp 87 PID 1700 wrote to memory of 748 1700 B17.tmp 88 PID 748 wrote to memory of 1444 748 BD2.tmp 89 PID 1444 wrote to memory of 3848 1444 C5F.tmp 90 PID 3848 wrote to memory of 2796 3848 CEC.tmp 91 PID 2796 wrote to memory of 3324 2796 D69.tmp 92 PID 3324 wrote to memory of 5076 3324 E24.tmp 93 PID 5076 wrote to memory of 4512 5076 EC0.tmp 94 PID 4512 wrote to memory of 4808 4512 F6C.tmp 95 PID 4808 wrote to memory of 4896 4808 1037.tmp 96 PID 4896 wrote to memory of 1944 4896 1122.tmp 97 PID 1944 wrote to memory of 852 1944 11AE.tmp 98 PID 852 wrote to memory of 2312 852 1289.tmp 99 PID 2312 wrote to memory of 2320 2312 1306.tmp 100 PID 2320 wrote to memory of 3728 2320 13B2.tmp 101 PID 3728 wrote to memory of 2480 3728 146D.tmp 102 PID 2480 wrote to memory of 1148 2480 14EA.tmp 103 PID 1148 wrote to memory of 3768 1148 1577.tmp 104 PID 3768 wrote to memory of 2100 3768 1604.tmp 105 PID 2100 wrote to memory of 1368 2100 16A0.tmp 106 PID 1368 wrote to memory of 3284 1368 175B.tmp 107 PID 3284 wrote to memory of 2932 3284 17C9.tmp 108 PID 2932 wrote to memory of 4180 2932 1884.tmp 109 PID 4180 wrote to memory of 4220 4180 1901.tmp 110 PID 4220 wrote to memory of 4764 4220 199E.tmp 111 PID 4764 wrote to memory of 4516 4764 1A3A.tmp 112 PID 4516 wrote to memory of 1692 4516 1AC6.tmp 113 PID 1692 wrote to memory of 224 1692 1B34.tmp 114 PID 224 wrote to memory of 3268 224 1BEF.tmp 115 PID 3268 wrote to memory of 1688 3268 1CAB.tmp 116 PID 1688 wrote to memory of 4704 1688 1D47.tmp 117 PID 4704 wrote to memory of 3388 4704 1DE3.tmp 118 PID 3388 wrote to memory of 2272 3388 1E41.tmp 119 PID 2272 wrote to memory of 3460 2272 1EAE.tmp 120 PID 3460 wrote to memory of 3900 3460 1EFD.tmp 121 PID 3900 wrote to memory of 4196 3900 1F4B.tmp 122 PID 4196 wrote to memory of 3816 4196 1F99.tmp 123 PID 3816 wrote to memory of 1812 3816 1FF7.tmp 124 PID 1812 wrote to memory of 3280 1812 2045.tmp 125 PID 3280 wrote to memory of 2244 3280 2093.tmp 126 PID 2244 wrote to memory of 4840 2244 20E1.tmp 127 PID 4840 wrote to memory of 1844 4840 214E.tmp 128 PID 1844 wrote to memory of 412 1844 219C.tmp 129 PID 412 wrote to memory of 2852 412 21FA.tmp 130 PID 2852 wrote to memory of 3400 2852 2248.tmp 131 PID 3400 wrote to memory of 2228 3400 2296.tmp 132 PID 2228 wrote to memory of 4036 2228 22E5.tmp 133 PID 4036 wrote to memory of 2896 4036 2342.tmp 134 PID 2896 wrote to memory of 4428 2896 2390.tmp 135 PID 4428 wrote to memory of 1548 4428 23EE.tmp 136 PID 1548 wrote to memory of 3504 1548 243C.tmp 137 PID 3504 wrote to memory of 4200 3504 248A.tmp 138 PID 4200 wrote to memory of 1472 4200 24D9.tmp 139 PID 1472 wrote to memory of 3060 1472 2527.tmp 140 PID 3060 wrote to memory of 4312 3060 2584.tmp 141 PID 4312 wrote to memory of 1172 4312 25E2.tmp 142 PID 1172 wrote to memory of 2776 1172 2650.tmp 143 PID 2776 wrote to memory of 3048 2776 26CD.tmp 144 PID 3048 wrote to memory of 4348 3048 273A.tmp 145 PID 4348 wrote to memory of 768 4348 2788.tmp 146 PID 768 wrote to memory of 3524 768 27D6.tmp 147 PID 3524 wrote to memory of 2904 3524 2834.tmp 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-05_520d343148b7344b1dac0a4eac3ee00f_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-05_520d343148b7344b1dac0a4eac3ee00f_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\A5B.tmp"C:\Users\Admin\AppData\Local\Temp\A5B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\B17.tmp"C:\Users\Admin\AppData\Local\Temp\B17.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\BD2.tmp"C:\Users\Admin\AppData\Local\Temp\BD2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\1037.tmp"C:\Users\Admin\AppData\Local\Temp\1037.tmp"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\1122.tmp"C:\Users\Admin\AppData\Local\Temp\1122.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\1289.tmp"C:\Users\Admin\AppData\Local\Temp\1289.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\1306.tmp"C:\Users\Admin\AppData\Local\Temp\1306.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\13B2.tmp"C:\Users\Admin\AppData\Local\Temp\13B2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\146D.tmp"C:\Users\Admin\AppData\Local\Temp\146D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\14EA.tmp"C:\Users\Admin\AppData\Local\Temp\14EA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\1901.tmp"C:\Users\Admin\AppData\Local\Temp\1901.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\199E.tmp"C:\Users\Admin\AppData\Local\Temp\199E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"C:\Users\Admin\AppData\Local\Temp\1A3A.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"C:\Users\Admin\AppData\Local\Temp\1AC6.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\1B34.tmp"C:\Users\Admin\AppData\Local\Temp\1B34.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"C:\Users\Admin\AppData\Local\Temp\1BEF.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"C:\Users\Admin\AppData\Local\Temp\1CAB.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\1D47.tmp"C:\Users\Admin\AppData\Local\Temp\1D47.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"C:\Users\Admin\AppData\Local\Temp\1DE3.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"C:\Users\Admin\AppData\Local\Temp\1EAE.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"C:\Users\Admin\AppData\Local\Temp\1EFD.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\1F99.tmp"C:\Users\Admin\AppData\Local\Temp\1F99.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\2045.tmp"C:\Users\Admin\AppData\Local\Temp\2045.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\2093.tmp"C:\Users\Admin\AppData\Local\Temp\2093.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\20E1.tmp"C:\Users\Admin\AppData\Local\Temp\20E1.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\214E.tmp"C:\Users\Admin\AppData\Local\Temp\214E.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\219C.tmp"C:\Users\Admin\AppData\Local\Temp\219C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\21FA.tmp"C:\Users\Admin\AppData\Local\Temp\21FA.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\2248.tmp"C:\Users\Admin\AppData\Local\Temp\2248.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\2296.tmp"C:\Users\Admin\AppData\Local\Temp\2296.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\2342.tmp"C:\Users\Admin\AppData\Local\Temp\2342.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\2390.tmp"C:\Users\Admin\AppData\Local\Temp\2390.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\243C.tmp"C:\Users\Admin\AppData\Local\Temp\243C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\248A.tmp"C:\Users\Admin\AppData\Local\Temp\248A.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\24D9.tmp"C:\Users\Admin\AppData\Local\Temp\24D9.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\2527.tmp"C:\Users\Admin\AppData\Local\Temp\2527.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\2584.tmp"C:\Users\Admin\AppData\Local\Temp\2584.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\25E2.tmp"C:\Users\Admin\AppData\Local\Temp\25E2.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\2650.tmp"C:\Users\Admin\AppData\Local\Temp\2650.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\26CD.tmp"C:\Users\Admin\AppData\Local\Temp\26CD.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\273A.tmp"C:\Users\Admin\AppData\Local\Temp\273A.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\2788.tmp"C:\Users\Admin\AppData\Local\Temp\2788.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\27D6.tmp"C:\Users\Admin\AppData\Local\Temp\27D6.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\2834.tmp"C:\Users\Admin\AppData\Local\Temp\2834.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\2882.tmp"C:\Users\Admin\AppData\Local\Temp\2882.tmp"65⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\28E0.tmp"C:\Users\Admin\AppData\Local\Temp\28E0.tmp"66⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\293E.tmp"C:\Users\Admin\AppData\Local\Temp\293E.tmp"67⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\298C.tmp"C:\Users\Admin\AppData\Local\Temp\298C.tmp"68⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\29DA.tmp"C:\Users\Admin\AppData\Local\Temp\29DA.tmp"69⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\2A28.tmp"C:\Users\Admin\AppData\Local\Temp\2A28.tmp"70⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\2A95.tmp"C:\Users\Admin\AppData\Local\Temp\2A95.tmp"71⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"72⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\2B32.tmp"C:\Users\Admin\AppData\Local\Temp\2B32.tmp"73⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\2B80.tmp"C:\Users\Admin\AppData\Local\Temp\2B80.tmp"74⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"C:\Users\Admin\AppData\Local\Temp\2BCE.tmp"75⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"C:\Users\Admin\AppData\Local\Temp\2C2C.tmp"76⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\2C89.tmp"C:\Users\Admin\AppData\Local\Temp\2C89.tmp"77⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"78⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\2D35.tmp"C:\Users\Admin\AppData\Local\Temp\2D35.tmp"79⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\2D83.tmp"C:\Users\Admin\AppData\Local\Temp\2D83.tmp"80⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"81⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"82⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"C:\Users\Admin\AppData\Local\Temp\2EBC.tmp"83⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"84⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\2F87.tmp"C:\Users\Admin\AppData\Local\Temp\2F87.tmp"85⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"86⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\3023.tmp"C:\Users\Admin\AppData\Local\Temp\3023.tmp"87⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\3071.tmp"C:\Users\Admin\AppData\Local\Temp\3071.tmp"88⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\30BF.tmp"C:\Users\Admin\AppData\Local\Temp\30BF.tmp"89⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\311D.tmp"C:\Users\Admin\AppData\Local\Temp\311D.tmp"90⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\316B.tmp"C:\Users\Admin\AppData\Local\Temp\316B.tmp"91⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"92⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"93⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"94⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"95⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"96⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"97⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"98⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"99⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\343A.tmp"C:\Users\Admin\AppData\Local\Temp\343A.tmp"100⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"101⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\34D6.tmp"C:\Users\Admin\AppData\Local\Temp\34D6.tmp"102⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\3524.tmp"C:\Users\Admin\AppData\Local\Temp\3524.tmp"103⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"104⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\35C1.tmp"C:\Users\Admin\AppData\Local\Temp\35C1.tmp"105⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\360F.tmp"C:\Users\Admin\AppData\Local\Temp\360F.tmp"106⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\367C.tmp"C:\Users\Admin\AppData\Local\Temp\367C.tmp"107⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\36CA.tmp"C:\Users\Admin\AppData\Local\Temp\36CA.tmp"108⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\3718.tmp"C:\Users\Admin\AppData\Local\Temp\3718.tmp"109⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\3767.tmp"C:\Users\Admin\AppData\Local\Temp\3767.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:984 -
C:\Users\Admin\AppData\Local\Temp\37D4.tmp"C:\Users\Admin\AppData\Local\Temp\37D4.tmp"111⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"112⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\388F.tmp"C:\Users\Admin\AppData\Local\Temp\388F.tmp"113⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\390C.tmp"C:\Users\Admin\AppData\Local\Temp\390C.tmp"114⤵
- System Location Discovery: System Language Discovery
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"115⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\39D8.tmp"C:\Users\Admin\AppData\Local\Temp\39D8.tmp"116⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\3A35.tmp"C:\Users\Admin\AppData\Local\Temp\3A35.tmp"117⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\3A93.tmp"C:\Users\Admin\AppData\Local\Temp\3A93.tmp"118⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\3B00.tmp"C:\Users\Admin\AppData\Local\Temp\3B00.tmp"119⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"120⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"121⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"122⤵PID:3468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-