Analysis
- max time kernel
150s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/05/2026, 22:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-05_7aebf5b26d2b7cd50ccc9781197e24e0_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-05_7aebf5b26d2b7cd50ccc9781197e24e0_elex_mafia_stealc_tofsee.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-05-05_7aebf5b26d2b7cd50ccc9781197e24e0_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260505-2plemscs5p
- SHA256 d6b23f5f28f0bbccec8c07aabd7930cdd86ef5b846fd5e73786f53dc74b15492
- MD5 7aebf5b26d2b7cd50ccc9781197e24e0
- SHA1 8f5361f495ada15a47cbb2d139af38eb1b55d87d
- SHA512 38f15aeee8afacdd321e91cdbe416fe4a0a35996ac86c5874013bfda226b2677f8cfcc705035c8c0c508870bd8e6bb4218379a45037e2728090172be5d697500
- SSDEEP 12288:NU5rCOTeijYXes5awgJCGsIl9kXgBGj6TZwlH:NUQOJjYusQb4Cl9mgDTSlH
- TLSH T1B8B4F0217185C132E6C202710BE6EBB2293E7D35076664C33B94666E2FB63E1E775347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3328 43BB.tmp 4664 4428.tmp 4828 4486.tmp 4764 44F3.tmp 4852 4551.tmp 5380 45DE.tmp 6128 467A.tmp 5484 46D8.tmp 1628 4735.tmp 4608 47A3.tmp 3464 4820.tmp 4668 489D.tmp 4420 490A.tmp 5204 4987.tmp 5740 49F5.tmp 3800 4A72.tmp 3380 4AEF.tmp 5820 4B6C.tmp 5932 4BE9.tmp 5600 4C46.tmp 5824 4CC3.tmp 3592 4D50.tmp 1784 4D9E.tmp 3476 4E0B.tmp 5144 4E4A.tmp 1300 4ED7.tmp 5068 4F63.tmp 5980 4FB1.tmp 5648 502E.tmp 2708 50AB.tmp 4076 50EA.tmp 3404 5157.tmp 4000 51C5.tmp 2900 5222.tmp 4520 5270.tmp 3412 52CE.tmp 5128 530D.tmp 5300 535B.tmp 4280 53A9.tmp 2376 53F7.tmp 5780 5455.tmp 5708 54B3.tmp 1792 5510.tmp 1924 555E.tmp 5700 559D.tmp 4360 55DB.tmp 3892 562A.tmp 1324 5678.tmp 4560 56B6.tmp 1872 5704.tmp 1092 5762.tmp 828 57B0.tmp 5492 57FE.tmp 5860 583D.tmp 3056 588B.tmp 64 58C9.tmp 5536 5918.tmp 1584 5956.tmp 4880 59A4.tmp 4292 5A02.tmp 4928 5A50.tmp 5124 5A9E.tmp 3040 5ADD.tmp 5524 5B2B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 654D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F45E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 994D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A524.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4099.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 117B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC6E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6567.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9342.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C1E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5616 wrote to memory of 3328 5616 2026-05-05_7aebf5b26d2b7cd50ccc9781197e24e0_elex_mafia_stealc_tofsee.exe 84 PID 3328 wrote to memory of 4664 3328 43BB.tmp 85 PID 4664 wrote to memory of 4828 4664 4428.tmp 86 PID 4828 wrote to memory of 4764 4828 4486.tmp 87 PID 4764 wrote to memory of 4852 4764 44F3.tmp 88 PID 4852 wrote to memory of 5380 4852 4551.tmp 89 PID 5380 wrote to memory of 6128 5380 45DE.tmp 90 PID 6128 wrote to memory of 5484 6128 467A.tmp 91 PID 5484 wrote to memory of 1628 5484 46D8.tmp 92 PID 1628 wrote to memory of 4608 1628 4735.tmp 93 PID 4608 wrote to memory of 3464 4608 47A3.tmp 94 PID 3464 wrote to memory of 4668 3464 4820.tmp 95 PID 4668 wrote to memory of 4420 4668 489D.tmp 96 PID 4420 wrote to memory of 5204 4420 490A.tmp 97 PID 5204 wrote to memory of 5740 5204 4987.tmp 98 PID 5740 wrote to memory of 3800 5740 49F5.tmp 99 PID 3800 wrote to memory of 3380 3800 4A72.tmp 100 PID 3380 wrote to memory of 5820 3380 4AEF.tmp 101 PID 5820 wrote to memory of 5932 5820 4B6C.tmp 102 PID 5932 wrote to memory of 5600 5932 4BE9.tmp 103 PID 5600 wrote to memory of 5824 5600 4C46.tmp 104 PID 5824 wrote to memory of 3592 5824 4CC3.tmp 105 PID 3592 wrote to memory of 1784 3592 4D50.tmp 106 PID 1784 wrote to memory of 3476 1784 4D9E.tmp 107 PID 3476 wrote to memory of 5144 3476 4E0B.tmp 108 PID 5144 wrote to memory of 1300 5144 4E4A.tmp 109 PID 1300 wrote to memory of 5068 1300 4ED7.tmp 110 PID 5068 wrote to memory of 5980 5068 4F63.tmp 111 PID 5980 wrote to memory of 5648 5980 4FB1.tmp 112 PID 5648 wrote to memory of 2708 5648 502E.tmp 113 PID 2708 wrote to memory of 4076 2708 50AB.tmp 114 PID 4076 wrote to memory of 3404 4076 50EA.tmp 115 PID 3404 wrote to memory of 4000 3404 5157.tmp 116 PID 4000 wrote to memory of 2900 4000 51C5.tmp 117 PID 2900 wrote to memory of 4520 2900 5222.tmp 118 PID 4520 wrote to memory of 3412 4520 5270.tmp 119 PID 3412 wrote to memory of 5128 3412 52CE.tmp 120 PID 5128 wrote to memory of 5300 5128 530D.tmp 121 PID 5300 wrote to memory of 4280 5300 535B.tmp 122 PID 4280 wrote to memory of 2376 4280 53A9.tmp 123 PID 2376 wrote to memory of 5780 2376 53F7.tmp 124 PID 5780 wrote to memory of 5708 5780 5455.tmp 125 PID 5708 wrote to memory of 1792 5708 54B3.tmp 126 PID 1792 wrote to memory of 1924 1792 5510.tmp 127 PID 1924 wrote to memory of 5700 1924 555E.tmp 128 PID 5700 wrote to memory of 4360 5700 559D.tmp 129 PID 4360 wrote to memory of 3892 4360 55DB.tmp 130 PID 3892 wrote to memory of 1324 3892 562A.tmp 131 PID 1324 wrote to memory of 4560 1324 5678.tmp 132 PID 4560 wrote to memory of 1872 4560 56B6.tmp 133 PID 1872 wrote to memory of 1092 1872 5704.tmp 134 PID 1092 wrote to memory of 828 1092 5762.tmp 135 PID 828 wrote to memory of 5492 828 57B0.tmp 136 PID 5492 wrote to memory of 5860 5492 57FE.tmp 137 PID 5860 wrote to memory of 3056 5860 583D.tmp 138 PID 3056 wrote to memory of 64 3056 588B.tmp 139 PID 64 wrote to memory of 5536 64 58C9.tmp 140 PID 5536 wrote to memory of 1584 5536 5918.tmp 141 PID 1584 wrote to memory of 4880 1584 5956.tmp 142 PID 4880 wrote to memory of 4292 4880 59A4.tmp 143 PID 4292 wrote to memory of 4928 4292 5A02.tmp 144 PID 4928 wrote to memory of 5124 4928 5A50.tmp 145 PID 5124 wrote to memory of 3040 5124 5A9E.tmp 146 PID 3040 wrote to memory of 5524 3040 5ADD.tmp 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-05_7aebf5b26d2b7cd50ccc9781197e24e0_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-05_7aebf5b26d2b7cd50ccc9781197e24e0_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5616 -
C:\Users\Admin\AppData\Local\Temp\43BB.tmp"C:\Users\Admin\AppData\Local\Temp\43BB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\4428.tmp"C:\Users\Admin\AppData\Local\Temp\4428.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\4486.tmp"C:\Users\Admin\AppData\Local\Temp\4486.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\44F3.tmp"C:\Users\Admin\AppData\Local\Temp\44F3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\45DE.tmp"C:\Users\Admin\AppData\Local\Temp\45DE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Users\Admin\AppData\Local\Temp\467A.tmp"C:\Users\Admin\AppData\Local\Temp\467A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\46D8.tmp"C:\Users\Admin\AppData\Local\Temp\46D8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\4735.tmp"C:\Users\Admin\AppData\Local\Temp\4735.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\47A3.tmp"C:\Users\Admin\AppData\Local\Temp\47A3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\4820.tmp"C:\Users\Admin\AppData\Local\Temp\4820.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\489D.tmp"C:\Users\Admin\AppData\Local\Temp\489D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\490A.tmp"C:\Users\Admin\AppData\Local\Temp\490A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\4987.tmp"C:\Users\Admin\AppData\Local\Temp\4987.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Users\Admin\AppData\Local\Temp\49F5.tmp"C:\Users\Admin\AppData\Local\Temp\49F5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5740 -
C:\Users\Admin\AppData\Local\Temp\4A72.tmp"C:\Users\Admin\AppData\Local\Temp\4A72.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"C:\Users\Admin\AppData\Local\Temp\4AEF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"C:\Users\Admin\AppData\Local\Temp\4B6C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5820 -
C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5932 -
C:\Users\Admin\AppData\Local\Temp\4C46.tmp"C:\Users\Admin\AppData\Local\Temp\4C46.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\4D50.tmp"C:\Users\Admin\AppData\Local\Temp\4D50.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"C:\Users\Admin\AppData\Local\Temp\4E0B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5144 -
C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\4F63.tmp"C:\Users\Admin\AppData\Local\Temp\4F63.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\502E.tmp"C:\Users\Admin\AppData\Local\Temp\502E.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Users\Admin\AppData\Local\Temp\50AB.tmp"C:\Users\Admin\AppData\Local\Temp\50AB.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\50EA.tmp"C:\Users\Admin\AppData\Local\Temp\50EA.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\5157.tmp"C:\Users\Admin\AppData\Local\Temp\5157.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\51C5.tmp"C:\Users\Admin\AppData\Local\Temp\51C5.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\5222.tmp"C:\Users\Admin\AppData\Local\Temp\5222.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\5270.tmp"C:\Users\Admin\AppData\Local\Temp\5270.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\52CE.tmp"C:\Users\Admin\AppData\Local\Temp\52CE.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\530D.tmp"C:\Users\Admin\AppData\Local\Temp\530D.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\535B.tmp"C:\Users\Admin\AppData\Local\Temp\535B.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Users\Admin\AppData\Local\Temp\53A9.tmp"C:\Users\Admin\AppData\Local\Temp\53A9.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\53F7.tmp"C:\Users\Admin\AppData\Local\Temp\53F7.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\5455.tmp"C:\Users\Admin\AppData\Local\Temp\5455.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Users\Admin\AppData\Local\Temp\54B3.tmp"C:\Users\Admin\AppData\Local\Temp\54B3.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5708 -
C:\Users\Admin\AppData\Local\Temp\5510.tmp"C:\Users\Admin\AppData\Local\Temp\5510.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\555E.tmp"C:\Users\Admin\AppData\Local\Temp\555E.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\559D.tmp"C:\Users\Admin\AppData\Local\Temp\559D.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5700 -
C:\Users\Admin\AppData\Local\Temp\55DB.tmp"C:\Users\Admin\AppData\Local\Temp\55DB.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\562A.tmp"C:\Users\Admin\AppData\Local\Temp\562A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\5678.tmp"C:\Users\Admin\AppData\Local\Temp\5678.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\56B6.tmp"C:\Users\Admin\AppData\Local\Temp\56B6.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\5704.tmp"C:\Users\Admin\AppData\Local\Temp\5704.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\5762.tmp"C:\Users\Admin\AppData\Local\Temp\5762.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\57B0.tmp"C:\Users\Admin\AppData\Local\Temp\57B0.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\57FE.tmp"C:\Users\Admin\AppData\Local\Temp\57FE.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\583D.tmp"C:\Users\Admin\AppData\Local\Temp\583D.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Users\Admin\AppData\Local\Temp\588B.tmp"C:\Users\Admin\AppData\Local\Temp\588B.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\58C9.tmp"C:\Users\Admin\AppData\Local\Temp\58C9.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\5956.tmp"C:\Users\Admin\AppData\Local\Temp\5956.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\59A4.tmp"C:\Users\Admin\AppData\Local\Temp\59A4.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"65⤵
- Executes dropped EXE
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\5B89.tmp"C:\Users\Admin\AppData\Local\Temp\5B89.tmp"66⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"67⤵PID:5444
-
C:\Users\Admin\AppData\Local\Temp\5C34.tmp"C:\Users\Admin\AppData\Local\Temp\5C34.tmp"68⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\5C92.tmp"C:\Users\Admin\AppData\Local\Temp\5C92.tmp"69⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\5CE0.tmp"C:\Users\Admin\AppData\Local\Temp\5CE0.tmp"70⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"71⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"72⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"73⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\5E19.tmp"C:\Users\Admin\AppData\Local\Temp\5E19.tmp"74⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\5E67.tmp"C:\Users\Admin\AppData\Local\Temp\5E67.tmp"75⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"C:\Users\Admin\AppData\Local\Temp\5EA5.tmp"76⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\5EF4.tmp"C:\Users\Admin\AppData\Local\Temp\5EF4.tmp"77⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\5F42.tmp"C:\Users\Admin\AppData\Local\Temp\5F42.tmp"78⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\5F90.tmp"C:\Users\Admin\AppData\Local\Temp\5F90.tmp"79⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"80⤵PID:5836
-
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"81⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\607A.tmp"C:\Users\Admin\AppData\Local\Temp\607A.tmp"82⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\60B9.tmp"C:\Users\Admin\AppData\Local\Temp\60B9.tmp"83⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\6116.tmp"C:\Users\Admin\AppData\Local\Temp\6116.tmp"84⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\6155.tmp"C:\Users\Admin\AppData\Local\Temp\6155.tmp"85⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\6193.tmp"C:\Users\Admin\AppData\Local\Temp\6193.tmp"86⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\61E2.tmp"C:\Users\Admin\AppData\Local\Temp\61E2.tmp"87⤵PID:5556
-
C:\Users\Admin\AppData\Local\Temp\623F.tmp"C:\Users\Admin\AppData\Local\Temp\623F.tmp"88⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\628D.tmp"C:\Users\Admin\AppData\Local\Temp\628D.tmp"89⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\62DC.tmp"C:\Users\Admin\AppData\Local\Temp\62DC.tmp"90⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\6339.tmp"C:\Users\Admin\AppData\Local\Temp\6339.tmp"91⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\6387.tmp"C:\Users\Admin\AppData\Local\Temp\6387.tmp"92⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\63D6.tmp"C:\Users\Admin\AppData\Local\Temp\63D6.tmp"93⤵PID:5244
-
C:\Users\Admin\AppData\Local\Temp\6424.tmp"C:\Users\Admin\AppData\Local\Temp\6424.tmp"94⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\6472.tmp"C:\Users\Admin\AppData\Local\Temp\6472.tmp"95⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\64C0.tmp"C:\Users\Admin\AppData\Local\Temp\64C0.tmp"96⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\650E.tmp"C:\Users\Admin\AppData\Local\Temp\650E.tmp"97⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\654D.tmp"C:\Users\Admin\AppData\Local\Temp\654D.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\659B.tmp"C:\Users\Admin\AppData\Local\Temp\659B.tmp"99⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\65E9.tmp"C:\Users\Admin\AppData\Local\Temp\65E9.tmp"100⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\6637.tmp"C:\Users\Admin\AppData\Local\Temp\6637.tmp"101⤵PID:5672
-
C:\Users\Admin\AppData\Local\Temp\6695.tmp"C:\Users\Admin\AppData\Local\Temp\6695.tmp"102⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\66F2.tmp"C:\Users\Admin\AppData\Local\Temp\66F2.tmp"103⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\6750.tmp"C:\Users\Admin\AppData\Local\Temp\6750.tmp"104⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\679E.tmp"C:\Users\Admin\AppData\Local\Temp\679E.tmp"105⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\67EC.tmp"C:\Users\Admin\AppData\Local\Temp\67EC.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\684A.tmp"C:\Users\Admin\AppData\Local\Temp\684A.tmp"107⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\68A8.tmp"C:\Users\Admin\AppData\Local\Temp\68A8.tmp"108⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\68F6.tmp"C:\Users\Admin\AppData\Local\Temp\68F6.tmp"109⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\6954.tmp"C:\Users\Admin\AppData\Local\Temp\6954.tmp"110⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\69B2.tmp"C:\Users\Admin\AppData\Local\Temp\69B2.tmp"111⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"C:\Users\Admin\AppData\Local\Temp\6A0F.tmp"112⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"C:\Users\Admin\AppData\Local\Temp\6A5D.tmp"113⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"114⤵PID:6000
-
C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"C:\Users\Admin\AppData\Local\Temp\6AEA.tmp"115⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\6B48.tmp"C:\Users\Admin\AppData\Local\Temp\6B48.tmp"116⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"117⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\6BF4.tmp"C:\Users\Admin\AppData\Local\Temp\6BF4.tmp"118⤵PID:5376
-
C:\Users\Admin\AppData\Local\Temp\6C51.tmp"C:\Users\Admin\AppData\Local\Temp\6C51.tmp"119⤵PID:5572
-
C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"C:\Users\Admin\AppData\Local\Temp\6CA0.tmp"120⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"C:\Users\Admin\AppData\Local\Temp\6CEE.tmp"121⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"C:\Users\Admin\AppData\Local\Temp\6D3C.tmp"122⤵PID:1952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-