Analysis
- max time kernel
150s - max time network
136s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 12:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_bf5798cb65abdeae0102661a7d3143a1_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-11_bf5798cb65abdeae0102661a7d3143a1_elex_mafia_stealc_tofsee.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-05-11_bf5798cb65abdeae0102661a7d3143a1_elex_mafia_stealc_tofsee.exe
- Size 487KB
- Sample260511-pgzabac17m
- SHA256 e2013b54a53a75ac4d491970029cf0662f6f1a14b4ee169b990966089f60c245
- MD5 bf5798cb65abdeae0102661a7d3143a1
- SHA1 bfb1e363e3e6e6a1a6ac72669256f77aa3a41f6f
- SHA512 5c51d1bfa00414f3cc87aafb75b6f9c5cb97ff9828df6715c03e616415d39cee71321949be6fa0f7f9c90a3ac8f33af36ac3baffbfac99ff56d0cb10b88e8644
- SSDEEP 12288:HU5rCOTeiJB9IHtDiKX4lgXSSVTcc9zNZ:HUQOJJjPgYgTNzN
- TLSH T184B4F125B489C032F6D206354AE6EBB1693A7D325722A0C73B80777E6FB52D1E674343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3400 2BDD.tmp 4432 2C89.tmp 620 2CE7.tmp 4736 2D35.tmp 4356 2D93.tmp 3908 2E00.tmp 1616 2E4E.tmp 3060 2E9D.tmp 2992 2EEB.tmp 2308 2F39.tmp 4344 2F87.tmp 4684 2FD5.tmp 3288 3042.tmp 4456 30A0.tmp 1340 30EE.tmp 1560 313C.tmp 2100 319A.tmp 5056 31F8.tmp 4732 3256.tmp 2076 32B3.tmp 1512 3302.tmp 1984 335F.tmp 3416 33AD.tmp 4964 340B.tmp 4284 3469.tmp 720 34B7.tmp 876 3505.tmp 3648 3563.tmp 3040 35B1.tmp 1880 35FF.tmp 1456 364D.tmp 2352 369B.tmp 236 36EA.tmp 3692 3738.tmp 4612 3786.tmp 2580 37E4.tmp 3384 3841.tmp 1792 3880.tmp 3472 38DE.tmp 1836 391C.tmp 2892 396A.tmp 4152 39B8.tmp 3644 3A06.tmp 1104 3A55.tmp 2860 3AB2.tmp 1900 3B00.tmp 2612 3B3F.tmp 4752 3B7D.tmp 3568 3BCC.tmp 3296 3C1A.tmp 3796 3C68.tmp 4940 3CB6.tmp 2156 3D04.tmp 1748 3D71.tmp 3764 3DCF.tmp 3376 3E2D.tmp 4696 3EC9.tmp 1488 3F17.tmp 4016 3F94.tmp 3180 3FE2.tmp 3904 4050.tmp 4264 40AE.tmp 1220 410B.tmp 1652 41A8.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B810.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E6A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A61E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B987.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2745.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 837E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1851.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1572.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D740.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9083.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D84A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3388 wrote to memory of 3400 3388 2026-05-11_bf5798cb65abdeae0102661a7d3143a1_elex_mafia_stealc_tofsee.exe 80 PID 3400 wrote to memory of 4432 3400 2BDD.tmp 81 PID 4432 wrote to memory of 620 4432 2C89.tmp 82 PID 620 wrote to memory of 4736 620 2CE7.tmp 83 PID 4736 wrote to memory of 4356 4736 2D35.tmp 84 PID 4356 wrote to memory of 3908 4356 2D93.tmp 85 PID 3908 wrote to memory of 1616 3908 2E00.tmp 86 PID 1616 wrote to memory of 3060 1616 2E4E.tmp 87 PID 3060 wrote to memory of 2992 3060 2E9D.tmp 88 PID 2992 wrote to memory of 2308 2992 2EEB.tmp 89 PID 2308 wrote to memory of 4344 2308 2F39.tmp 90 PID 4344 wrote to memory of 4684 4344 2F87.tmp 91 PID 4684 wrote to memory of 3288 4684 2FD5.tmp 92 PID 3288 wrote to memory of 4456 3288 3042.tmp 93 PID 4456 wrote to memory of 1340 4456 30A0.tmp 94 PID 1340 wrote to memory of 1560 1340 30EE.tmp 95 PID 1560 wrote to memory of 2100 1560 313C.tmp 96 PID 2100 wrote to memory of 5056 2100 319A.tmp 97 PID 5056 wrote to memory of 4732 5056 31F8.tmp 98 PID 4732 wrote to memory of 2076 4732 3256.tmp 99 PID 2076 wrote to memory of 1512 2076 32B3.tmp 100 PID 1512 wrote to memory of 1984 1512 3302.tmp 101 PID 1984 wrote to memory of 3416 1984 335F.tmp 102 PID 3416 wrote to memory of 4964 3416 33AD.tmp 103 PID 4964 wrote to memory of 4284 4964 340B.tmp 104 PID 4284 wrote to memory of 720 4284 3469.tmp 105 PID 720 wrote to memory of 876 720 34B7.tmp 106 PID 876 wrote to memory of 3648 876 3505.tmp 107 PID 3648 wrote to memory of 3040 3648 3563.tmp 108 PID 3040 wrote to memory of 1880 3040 35B1.tmp 109 PID 1880 wrote to memory of 1456 1880 35FF.tmp 110 PID 1456 wrote to memory of 2352 1456 364D.tmp 111 PID 2352 wrote to memory of 236 2352 369B.tmp 112 PID 236 wrote to memory of 3692 236 36EA.tmp 113 PID 3692 wrote to memory of 4612 3692 3738.tmp 114 PID 4612 wrote to memory of 2580 4612 3786.tmp 115 PID 2580 wrote to memory of 3384 2580 37E4.tmp 116 PID 3384 wrote to memory of 1792 3384 3841.tmp 117 PID 1792 wrote to memory of 3472 1792 3880.tmp 118 PID 3472 wrote to memory of 1836 3472 38DE.tmp 119 PID 1836 wrote to memory of 2892 1836 391C.tmp 120 PID 2892 wrote to memory of 4152 2892 396A.tmp 121 PID 4152 wrote to memory of 3644 4152 39B8.tmp 122 PID 3644 wrote to memory of 1104 3644 3A06.tmp 123 PID 1104 wrote to memory of 2860 1104 3A55.tmp 124 PID 2860 wrote to memory of 1900 2860 3AB2.tmp 125 PID 1900 wrote to memory of 2612 1900 3B00.tmp 126 PID 2612 wrote to memory of 4752 2612 3B3F.tmp 127 PID 4752 wrote to memory of 3568 4752 3B7D.tmp 128 PID 3568 wrote to memory of 3296 3568 3BCC.tmp 129 PID 3296 wrote to memory of 3796 3296 3C1A.tmp 130 PID 3796 wrote to memory of 4940 3796 3C68.tmp 131 PID 4940 wrote to memory of 2156 4940 3CB6.tmp 132 PID 2156 wrote to memory of 1748 2156 3D04.tmp 133 PID 1748 wrote to memory of 3764 1748 3D71.tmp 134 PID 3764 wrote to memory of 3376 3764 3DCF.tmp 135 PID 3376 wrote to memory of 4696 3376 3E2D.tmp 136 PID 4696 wrote to memory of 1488 4696 3EC9.tmp 137 PID 1488 wrote to memory of 4016 1488 3F17.tmp 138 PID 4016 wrote to memory of 3180 4016 3F94.tmp 139 PID 3180 wrote to memory of 3904 3180 3FE2.tmp 140 PID 3904 wrote to memory of 4264 3904 4050.tmp 141 PID 4264 wrote to memory of 1220 4264 40AE.tmp 142 PID 1220 wrote to memory of 1652 1220 410B.tmp 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_bf5798cb65abdeae0102661a7d3143a1_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_bf5798cb65abdeae0102661a7d3143a1_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\2C89.tmp"C:\Users\Admin\AppData\Local\Temp\2C89.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\2D35.tmp"C:\Users\Admin\AppData\Local\Temp\2D35.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\2D93.tmp"C:\Users\Admin\AppData\Local\Temp\2D93.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\2E00.tmp"C:\Users\Admin\AppData\Local\Temp\2E00.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"C:\Users\Admin\AppData\Local\Temp\2E4E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"C:\Users\Admin\AppData\Local\Temp\2E9D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\2F39.tmp"C:\Users\Admin\AppData\Local\Temp\2F39.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\2F87.tmp"C:\Users\Admin\AppData\Local\Temp\2F87.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"C:\Users\Admin\AppData\Local\Temp\2FD5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\3042.tmp"C:\Users\Admin\AppData\Local\Temp\3042.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\30A0.tmp"C:\Users\Admin\AppData\Local\Temp\30A0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\30EE.tmp"C:\Users\Admin\AppData\Local\Temp\30EE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\313C.tmp"C:\Users\Admin\AppData\Local\Temp\313C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\31F8.tmp"C:\Users\Admin\AppData\Local\Temp\31F8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\32B3.tmp"C:\Users\Admin\AppData\Local\Temp\32B3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\335F.tmp"C:\Users\Admin\AppData\Local\Temp\335F.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\33AD.tmp"C:\Users\Admin\AppData\Local\Temp\33AD.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\3563.tmp"C:\Users\Admin\AppData\Local\Temp\3563.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\35B1.tmp"C:\Users\Admin\AppData\Local\Temp\35B1.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\35FF.tmp"C:\Users\Admin\AppData\Local\Temp\35FF.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\364D.tmp"C:\Users\Admin\AppData\Local\Temp\364D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\369B.tmp"C:\Users\Admin\AppData\Local\Temp\369B.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\36EA.tmp"C:\Users\Admin\AppData\Local\Temp\36EA.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\3738.tmp"C:\Users\Admin\AppData\Local\Temp\3738.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\3786.tmp"C:\Users\Admin\AppData\Local\Temp\3786.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3841.tmp"C:\Users\Admin\AppData\Local\Temp\3841.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\3880.tmp"C:\Users\Admin\AppData\Local\Temp\3880.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\38DE.tmp"C:\Users\Admin\AppData\Local\Temp\38DE.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\391C.tmp"C:\Users\Admin\AppData\Local\Temp\391C.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\39B8.tmp"C:\Users\Admin\AppData\Local\Temp\39B8.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\3A06.tmp"C:\Users\Admin\AppData\Local\Temp\3A06.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\3A55.tmp"C:\Users\Admin\AppData\Local\Temp\3A55.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"C:\Users\Admin\AppData\Local\Temp\3AB2.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\3B00.tmp"C:\Users\Admin\AppData\Local\Temp\3B00.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\3BCC.tmp"C:\Users\Admin\AppData\Local\Temp\3BCC.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"C:\Users\Admin\AppData\Local\Temp\3C1A.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\3C68.tmp"C:\Users\Admin\AppData\Local\Temp\3C68.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"C:\Users\Admin\AppData\Local\Temp\3CB6.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\3D04.tmp"C:\Users\Admin\AppData\Local\Temp\3D04.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\3D71.tmp"C:\Users\Admin\AppData\Local\Temp\3D71.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3DCF.tmp"C:\Users\Admin\AppData\Local\Temp\3DCF.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\3F17.tmp"C:\Users\Admin\AppData\Local\Temp\3F17.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\3F94.tmp"C:\Users\Admin\AppData\Local\Temp\3F94.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"C:\Users\Admin\AppData\Local\Temp\3FE2.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\4050.tmp"C:\Users\Admin\AppData\Local\Temp\4050.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\40AE.tmp"C:\Users\Admin\AppData\Local\Temp\40AE.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\410B.tmp"C:\Users\Admin\AppData\Local\Temp\410B.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\41A8.tmp"C:\Users\Admin\AppData\Local\Temp\41A8.tmp"65⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\4205.tmp"C:\Users\Admin\AppData\Local\Temp\4205.tmp"66⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\4273.tmp"C:\Users\Admin\AppData\Local\Temp\4273.tmp"67⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\42D0.tmp"C:\Users\Admin\AppData\Local\Temp\42D0.tmp"68⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\431F.tmp"C:\Users\Admin\AppData\Local\Temp\431F.tmp"69⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\437C.tmp"C:\Users\Admin\AppData\Local\Temp\437C.tmp"70⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\43CA.tmp"C:\Users\Admin\AppData\Local\Temp\43CA.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\4419.tmp"C:\Users\Admin\AppData\Local\Temp\4419.tmp"72⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\4467.tmp"C:\Users\Admin\AppData\Local\Temp\4467.tmp"73⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\44C4.tmp"C:\Users\Admin\AppData\Local\Temp\44C4.tmp"74⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\4513.tmp"C:\Users\Admin\AppData\Local\Temp\4513.tmp"75⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\4561.tmp"C:\Users\Admin\AppData\Local\Temp\4561.tmp"76⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\45BE.tmp"C:\Users\Admin\AppData\Local\Temp\45BE.tmp"77⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\460D.tmp"C:\Users\Admin\AppData\Local\Temp\460D.tmp"78⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\467A.tmp"C:\Users\Admin\AppData\Local\Temp\467A.tmp"79⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\46E7.tmp"C:\Users\Admin\AppData\Local\Temp\46E7.tmp"80⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\4735.tmp"C:\Users\Admin\AppData\Local\Temp\4735.tmp"81⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\4784.tmp"C:\Users\Admin\AppData\Local\Temp\4784.tmp"82⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\47D2.tmp"C:\Users\Admin\AppData\Local\Temp\47D2.tmp"83⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\482F.tmp"C:\Users\Admin\AppData\Local\Temp\482F.tmp"84⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\487E.tmp"C:\Users\Admin\AppData\Local\Temp\487E.tmp"85⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\48EB.tmp"C:\Users\Admin\AppData\Local\Temp\48EB.tmp"86⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\4949.tmp"C:\Users\Admin\AppData\Local\Temp\4949.tmp"87⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\49C6.tmp"C:\Users\Admin\AppData\Local\Temp\49C6.tmp"88⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\4A14.tmp"C:\Users\Admin\AppData\Local\Temp\4A14.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\4A72.tmp"C:\Users\Admin\AppData\Local\Temp\4A72.tmp"90⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"91⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"C:\Users\Admin\AppData\Local\Temp\4B2D.tmp"92⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"C:\Users\Admin\AppData\Local\Temp\4B9A.tmp"93⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"C:\Users\Admin\AppData\Local\Temp\4BE9.tmp"94⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\4C46.tmp"C:\Users\Admin\AppData\Local\Temp\4C46.tmp"95⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\4C94.tmp"C:\Users\Admin\AppData\Local\Temp\4C94.tmp"96⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"97⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\4D50.tmp"C:\Users\Admin\AppData\Local\Temp\4D50.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"C:\Users\Admin\AppData\Local\Temp\4D9E.tmp"99⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"100⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"101⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"C:\Users\Admin\AppData\Local\Temp\4EA8.tmp"102⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"103⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\4F44.tmp"C:\Users\Admin\AppData\Local\Temp\4F44.tmp"104⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"C:\Users\Admin\AppData\Local\Temp\4FB1.tmp"105⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\500F.tmp"C:\Users\Admin\AppData\Local\Temp\500F.tmp"106⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\505D.tmp"C:\Users\Admin\AppData\Local\Temp\505D.tmp"107⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\50CB.tmp"C:\Users\Admin\AppData\Local\Temp\50CB.tmp"108⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\5119.tmp"C:\Users\Admin\AppData\Local\Temp\5119.tmp"109⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\5176.tmp"C:\Users\Admin\AppData\Local\Temp\5176.tmp"110⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\51D4.tmp"C:\Users\Admin\AppData\Local\Temp\51D4.tmp"111⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\5222.tmp"C:\Users\Admin\AppData\Local\Temp\5222.tmp"112⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\5280.tmp"C:\Users\Admin\AppData\Local\Temp\5280.tmp"113⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\52ED.tmp"C:\Users\Admin\AppData\Local\Temp\52ED.tmp"114⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\534B.tmp"C:\Users\Admin\AppData\Local\Temp\534B.tmp"115⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\5399.tmp"C:\Users\Admin\AppData\Local\Temp\5399.tmp"116⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\53E7.tmp"C:\Users\Admin\AppData\Local\Temp\53E7.tmp"117⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\5445.tmp"C:\Users\Admin\AppData\Local\Temp\5445.tmp"118⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\5493.tmp"C:\Users\Admin\AppData\Local\Temp\5493.tmp"119⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\54E1.tmp"C:\Users\Admin\AppData\Local\Temp\54E1.tmp"120⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\553F.tmp"C:\Users\Admin\AppData\Local\Temp\553F.tmp"121⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\558D.tmp"C:\Users\Admin\AppData\Local\Temp\558D.tmp"122⤵PID:4336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-