Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/05/2026, 10:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-05_856518372c34db9009aa1170c51ce279_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-05_856518372c34db9009aa1170c51ce279_elex_mafia_stealc_tofsee.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-05-05_856518372c34db9009aa1170c51ce279_elex_mafia_stealc_tofsee.exe
- Size 644KB
- Sample260505-ma9flags9p
- SHA256 38bea85c3d4252b3b6e99f9c45991f2420e3269202a5a4850ed636882e4cfa42
- MD5 856518372c34db9009aa1170c51ce279
- SHA1 7adca75a045cfd561de20aac71d11d5e625ef03a
- SHA512 6b1c32fd6b0f8ee98d763225b54ff4f5d3cacb7a1059c4605bc25d69358c0fbcc5b62fae4bc9c966550f0a8a02eeece7d948b3fde56244942e87bb46dee523e4
- SSDEEP 12288:9U5rCOTei62gKihl+KQKW5sw1YH+V7qZoXWjdqpby1grA70G+o:9UQOJ62gJhlvT27qqGh4yATXo
- TLSH T129E40121B981C032E9D212744FE5EBB1696ABC354B2294C73BC4A76E6F752D1D338317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3248 53F7.tmp 2416 5464.tmp 4300 54C2.tmp 368 555E.tmp 2972 55CC.tmp 2120 5639.tmp 3900 56C6.tmp 3276 5743.tmp 1856 57A1.tmp 1148 581E.tmp 4460 587B.tmp 1812 58F8.tmp 892 5966.tmp 3980 59D3.tmp 3792 5A40.tmp 4064 5ACD.tmp 4440 5B2B.tmp 2224 5B89.tmp 2436 5BF6.tmp 3852 5C83.tmp 3308 5D2E.tmp 1104 5D7D.tmp 4280 5DFA.tmp 3748 5E77.tmp 848 5EE4.tmp 1840 5F42.tmp 1748 5FBF.tmp 1908 602C.tmp 2136 608A.tmp 3076 6107.tmp 4892 6174.tmp 4284 61D2.tmp 5076 623F.tmp 116 629D.tmp 5060 62EB.tmp 1820 6349.tmp 3496 6397.tmp 4528 63E5.tmp 1216 6443.tmp 3040 6491.tmp 4776 64EF.tmp 3064 653D.tmp 540 658B.tmp 3016 65D9.tmp 1640 6637.tmp 4948 6685.tmp 3060 66D3.tmp 4788 6741.tmp 2008 678F.tmp 1720 67DD.tmp 4848 682B.tmp 1204 6879.tmp 3108 68D7.tmp 4636 6925.tmp 2424 6983.tmp 1492 69C1.tmp 1648 6A1F.tmp 4436 6A6D.tmp 2764 6ABB.tmp 1372 6B09.tmp 3800 6B57.tmp 3116 6BB5.tmp 2656 6C03.tmp 2336 6C42.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F75B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3975.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B07F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7371.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6491.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 682B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7318.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D84A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6613.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 602C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5412.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9551.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F19E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7896.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B32E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 820 wrote to memory of 3248 820 2026-05-05_856518372c34db9009aa1170c51ce279_elex_mafia_stealc_tofsee.exe 83 PID 3248 wrote to memory of 2416 3248 53F7.tmp 84 PID 2416 wrote to memory of 4300 2416 5464.tmp 85 PID 4300 wrote to memory of 368 4300 54C2.tmp 86 PID 368 wrote to memory of 2972 368 555E.tmp 87 PID 2972 wrote to memory of 2120 2972 55CC.tmp 88 PID 2120 wrote to memory of 3900 2120 5639.tmp 89 PID 3900 wrote to memory of 3276 3900 56C6.tmp 90 PID 3276 wrote to memory of 1856 3276 5743.tmp 91 PID 1856 wrote to memory of 1148 1856 57A1.tmp 92 PID 1148 wrote to memory of 4460 1148 581E.tmp 93 PID 4460 wrote to memory of 1812 4460 587B.tmp 94 PID 1812 wrote to memory of 892 1812 58F8.tmp 95 PID 892 wrote to memory of 3980 892 5966.tmp 96 PID 3980 wrote to memory of 3792 3980 59D3.tmp 97 PID 3792 wrote to memory of 4064 3792 5A40.tmp 98 PID 4064 wrote to memory of 4440 4064 5ACD.tmp 99 PID 4440 wrote to memory of 2224 4440 5B2B.tmp 100 PID 2224 wrote to memory of 2436 2224 5B89.tmp 101 PID 2436 wrote to memory of 3852 2436 5BF6.tmp 102 PID 3852 wrote to memory of 3308 3852 5C83.tmp 103 PID 3308 wrote to memory of 1104 3308 5D2E.tmp 104 PID 1104 wrote to memory of 4280 1104 5D7D.tmp 105 PID 4280 wrote to memory of 3748 4280 5DFA.tmp 106 PID 3748 wrote to memory of 848 3748 5E77.tmp 107 PID 848 wrote to memory of 1840 848 5EE4.tmp 108 PID 1840 wrote to memory of 1748 1840 5F42.tmp 109 PID 1748 wrote to memory of 1908 1748 5FBF.tmp 110 PID 1908 wrote to memory of 2136 1908 602C.tmp 111 PID 2136 wrote to memory of 3076 2136 608A.tmp 112 PID 3076 wrote to memory of 4892 3076 6107.tmp 113 PID 4892 wrote to memory of 4284 4892 6174.tmp 114 PID 4284 wrote to memory of 5076 4284 61D2.tmp 115 PID 5076 wrote to memory of 116 5076 623F.tmp 116 PID 116 wrote to memory of 5060 116 629D.tmp 117 PID 5060 wrote to memory of 1820 5060 62EB.tmp 118 PID 1820 wrote to memory of 3496 1820 6349.tmp 119 PID 3496 wrote to memory of 4528 3496 6397.tmp 120 PID 4528 wrote to memory of 1216 4528 63E5.tmp 121 PID 1216 wrote to memory of 3040 1216 6443.tmp 122 PID 3040 wrote to memory of 4776 3040 6491.tmp 123 PID 4776 wrote to memory of 3064 4776 64EF.tmp 124 PID 3064 wrote to memory of 540 3064 653D.tmp 125 PID 540 wrote to memory of 3016 540 658B.tmp 126 PID 3016 wrote to memory of 1640 3016 65D9.tmp 127 PID 1640 wrote to memory of 4948 1640 6637.tmp 128 PID 4948 wrote to memory of 3060 4948 6685.tmp 129 PID 3060 wrote to memory of 4788 3060 66D3.tmp 130 PID 4788 wrote to memory of 2008 4788 6741.tmp 131 PID 2008 wrote to memory of 1720 2008 678F.tmp 132 PID 1720 wrote to memory of 4848 1720 67DD.tmp 133 PID 4848 wrote to memory of 1204 4848 682B.tmp 134 PID 1204 wrote to memory of 3108 1204 6879.tmp 135 PID 3108 wrote to memory of 4636 3108 68D7.tmp 136 PID 4636 wrote to memory of 2424 4636 6925.tmp 137 PID 2424 wrote to memory of 1492 2424 6983.tmp 138 PID 1492 wrote to memory of 1648 1492 69C1.tmp 139 PID 1648 wrote to memory of 4436 1648 6A1F.tmp 140 PID 4436 wrote to memory of 2764 4436 6A6D.tmp 141 PID 2764 wrote to memory of 1372 2764 6ABB.tmp 142 PID 1372 wrote to memory of 3800 1372 6B09.tmp 143 PID 3800 wrote to memory of 3116 3800 6B57.tmp 144 PID 3116 wrote to memory of 2656 3116 6BB5.tmp 145 PID 2656 wrote to memory of 2336 2656 6C03.tmp 146
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-05_856518372c34db9009aa1170c51ce279_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-05_856518372c34db9009aa1170c51ce279_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\53F7.tmp"C:\Users\Admin\AppData\Local\Temp\53F7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\5464.tmp"C:\Users\Admin\AppData\Local\Temp\5464.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\54C2.tmp"C:\Users\Admin\AppData\Local\Temp\54C2.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\555E.tmp"C:\Users\Admin\AppData\Local\Temp\555E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\55CC.tmp"C:\Users\Admin\AppData\Local\Temp\55CC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\5639.tmp"C:\Users\Admin\AppData\Local\Temp\5639.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\56C6.tmp"C:\Users\Admin\AppData\Local\Temp\56C6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\5743.tmp"C:\Users\Admin\AppData\Local\Temp\5743.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\57A1.tmp"C:\Users\Admin\AppData\Local\Temp\57A1.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\581E.tmp"C:\Users\Admin\AppData\Local\Temp\581E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\587B.tmp"C:\Users\Admin\AppData\Local\Temp\587B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\58F8.tmp"C:\Users\Admin\AppData\Local\Temp\58F8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\59D3.tmp"C:\Users\Admin\AppData\Local\Temp\59D3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\5A40.tmp"C:\Users\Admin\AppData\Local\Temp\5A40.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"C:\Users\Admin\AppData\Local\Temp\5ACD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\5B89.tmp"C:\Users\Admin\AppData\Local\Temp\5B89.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\5BF6.tmp"C:\Users\Admin\AppData\Local\Temp\5BF6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\5C83.tmp"C:\Users\Admin\AppData\Local\Temp\5C83.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"C:\Users\Admin\AppData\Local\Temp\5D2E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"C:\Users\Admin\AppData\Local\Temp\5D7D.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\5E77.tmp"C:\Users\Admin\AppData\Local\Temp\5E77.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"C:\Users\Admin\AppData\Local\Temp\5EE4.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\5F42.tmp"C:\Users\Admin\AppData\Local\Temp\5F42.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\608A.tmp"C:\Users\Admin\AppData\Local\Temp\608A.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\6107.tmp"C:\Users\Admin\AppData\Local\Temp\6107.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\6174.tmp"C:\Users\Admin\AppData\Local\Temp\6174.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\61D2.tmp"C:\Users\Admin\AppData\Local\Temp\61D2.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\623F.tmp"C:\Users\Admin\AppData\Local\Temp\623F.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\629D.tmp"C:\Users\Admin\AppData\Local\Temp\629D.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\62EB.tmp"C:\Users\Admin\AppData\Local\Temp\62EB.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\6349.tmp"C:\Users\Admin\AppData\Local\Temp\6349.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\6397.tmp"C:\Users\Admin\AppData\Local\Temp\6397.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\63E5.tmp"C:\Users\Admin\AppData\Local\Temp\63E5.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\6443.tmp"C:\Users\Admin\AppData\Local\Temp\6443.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\6491.tmp"C:\Users\Admin\AppData\Local\Temp\6491.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\64EF.tmp"C:\Users\Admin\AppData\Local\Temp\64EF.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\653D.tmp"C:\Users\Admin\AppData\Local\Temp\653D.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\658B.tmp"C:\Users\Admin\AppData\Local\Temp\658B.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\65D9.tmp"C:\Users\Admin\AppData\Local\Temp\65D9.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\6637.tmp"C:\Users\Admin\AppData\Local\Temp\6637.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\6685.tmp"C:\Users\Admin\AppData\Local\Temp\6685.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\66D3.tmp"C:\Users\Admin\AppData\Local\Temp\66D3.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\6741.tmp"C:\Users\Admin\AppData\Local\Temp\6741.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\678F.tmp"C:\Users\Admin\AppData\Local\Temp\678F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\67DD.tmp"C:\Users\Admin\AppData\Local\Temp\67DD.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\682B.tmp"C:\Users\Admin\AppData\Local\Temp\682B.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\6879.tmp"C:\Users\Admin\AppData\Local\Temp\6879.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\68D7.tmp"C:\Users\Admin\AppData\Local\Temp\68D7.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\6925.tmp"C:\Users\Admin\AppData\Local\Temp\6925.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\6983.tmp"C:\Users\Admin\AppData\Local\Temp\6983.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\69C1.tmp"C:\Users\Admin\AppData\Local\Temp\69C1.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\6A1F.tmp"C:\Users\Admin\AppData\Local\Temp\6A1F.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\6A6D.tmp"C:\Users\Admin\AppData\Local\Temp\6A6D.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\6ABB.tmp"C:\Users\Admin\AppData\Local\Temp\6ABB.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\6B09.tmp"C:\Users\Admin\AppData\Local\Temp\6B09.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\6B57.tmp"C:\Users\Admin\AppData\Local\Temp\6B57.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\6BB5.tmp"C:\Users\Admin\AppData\Local\Temp\6BB5.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\6C03.tmp"C:\Users\Admin\AppData\Local\Temp\6C03.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\6C42.tmp"C:\Users\Admin\AppData\Local\Temp\6C42.tmp"65⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\6C90.tmp"C:\Users\Admin\AppData\Local\Temp\6C90.tmp"66⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"67⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"68⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\6D7A.tmp"C:\Users\Admin\AppData\Local\Temp\6D7A.tmp"69⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\6DC8.tmp"C:\Users\Admin\AppData\Local\Temp\6DC8.tmp"70⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\6E07.tmp"C:\Users\Admin\AppData\Local\Temp\6E07.tmp"71⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\6E45.tmp"C:\Users\Admin\AppData\Local\Temp\6E45.tmp"72⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\6E94.tmp"C:\Users\Admin\AppData\Local\Temp\6E94.tmp"73⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"74⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"75⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"76⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"C:\Users\Admin\AppData\Local\Temp\6FDC.tmp"77⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\7039.tmp"C:\Users\Admin\AppData\Local\Temp\7039.tmp"78⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\7097.tmp"C:\Users\Admin\AppData\Local\Temp\7097.tmp"79⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\70F5.tmp"C:\Users\Admin\AppData\Local\Temp\70F5.tmp"80⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\7143.tmp"C:\Users\Admin\AppData\Local\Temp\7143.tmp"81⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\7182.tmp"C:\Users\Admin\AppData\Local\Temp\7182.tmp"82⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\71C0.tmp"C:\Users\Admin\AppData\Local\Temp\71C0.tmp"83⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\721E.tmp"C:\Users\Admin\AppData\Local\Temp\721E.tmp"84⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\727C.tmp"C:\Users\Admin\AppData\Local\Temp\727C.tmp"85⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\72CA.tmp"C:\Users\Admin\AppData\Local\Temp\72CA.tmp"86⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\7318.tmp"C:\Users\Admin\AppData\Local\Temp\7318.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\7366.tmp"C:\Users\Admin\AppData\Local\Temp\7366.tmp"88⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\73B4.tmp"C:\Users\Admin\AppData\Local\Temp\73B4.tmp"89⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\7402.tmp"C:\Users\Admin\AppData\Local\Temp\7402.tmp"90⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\7450.tmp"C:\Users\Admin\AppData\Local\Temp\7450.tmp"91⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\749E.tmp"C:\Users\Admin\AppData\Local\Temp\749E.tmp"92⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\74ED.tmp"C:\Users\Admin\AppData\Local\Temp\74ED.tmp"93⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\753B.tmp"C:\Users\Admin\AppData\Local\Temp\753B.tmp"94⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\7589.tmp"C:\Users\Admin\AppData\Local\Temp\7589.tmp"95⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\75D7.tmp"C:\Users\Admin\AppData\Local\Temp\75D7.tmp"96⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\7625.tmp"C:\Users\Admin\AppData\Local\Temp\7625.tmp"97⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\7673.tmp"C:\Users\Admin\AppData\Local\Temp\7673.tmp"98⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\76C1.tmp"C:\Users\Admin\AppData\Local\Temp\76C1.tmp"99⤵PID:3252
-
C:\Users\Admin\AppData\Local\Temp\770F.tmp"C:\Users\Admin\AppData\Local\Temp\770F.tmp"100⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\775E.tmp"C:\Users\Admin\AppData\Local\Temp\775E.tmp"101⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\77BB.tmp"C:\Users\Admin\AppData\Local\Temp\77BB.tmp"102⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\7809.tmp"C:\Users\Admin\AppData\Local\Temp\7809.tmp"103⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\7858.tmp"C:\Users\Admin\AppData\Local\Temp\7858.tmp"104⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\7896.tmp"C:\Users\Admin\AppData\Local\Temp\7896.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\78F4.tmp"C:\Users\Admin\AppData\Local\Temp\78F4.tmp"106⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\7932.tmp"C:\Users\Admin\AppData\Local\Temp\7932.tmp"107⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\7990.tmp"C:\Users\Admin\AppData\Local\Temp\7990.tmp"108⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\79EE.tmp"C:\Users\Admin\AppData\Local\Temp\79EE.tmp"109⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"C:\Users\Admin\AppData\Local\Temp\7A4C.tmp"110⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"111⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"112⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\7B46.tmp"C:\Users\Admin\AppData\Local\Temp\7B46.tmp"113⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\7B94.tmp"C:\Users\Admin\AppData\Local\Temp\7B94.tmp"114⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"C:\Users\Admin\AppData\Local\Temp\7BF1.tmp"115⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\7C40.tmp"C:\Users\Admin\AppData\Local\Temp\7C40.tmp"116⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"C:\Users\Admin\AppData\Local\Temp\7C8E.tmp"117⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\7CDC.tmp"C:\Users\Admin\AppData\Local\Temp\7CDC.tmp"118⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\7D2A.tmp"C:\Users\Admin\AppData\Local\Temp\7D2A.tmp"119⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\7D88.tmp"C:\Users\Admin\AppData\Local\Temp\7D88.tmp"120⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"121⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\7E34.tmp"C:\Users\Admin\AppData\Local\Temp\7E34.tmp"122⤵PID:4304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-