Analysis
- max time kernel
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/05/2026, 10:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-16_254422413d8e2109a9143307f7d0f2d6_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-16_254422413d8e2109a9143307f7d0f2d6_elex_mafia_stealc_tofsee.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-05-16_254422413d8e2109a9143307f7d0f2d6_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260516-mxtcwscy4x
- SHA256 552860c8c42d3ed697a32a5d8307be995525ac0a62406d494d85131f82196327
- MD5 254422413d8e2109a9143307f7d0f2d6
- SHA1 6b2b0df8504b944dac22c1ae99e4be31230b1c62
- SHA512 b431a887f00b5f6458c563ba8b518d6d3a5aad2d5beeda7a38a74fe6b5073f7072081c8473f3469f372cd5ee2968d35130e70482fed599baf2027c6e31b68e46
- SSDEEP 12288:NU5rCOTeij7dNnVfDFwbOjiP6ZVT0PGLTZwlH:NUQOJj7dNVf9jhZtGGLTSlH
- TLSH T1A4B4F126B585C032E6D211314FE6EBB16A3E7D354722A4C72B94663E2FB13E1D739342
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 1680 A92C.tmp 684 A9B8.tmp 4536 AA64.tmp 4920 AB2F.tmp 4352 ABAC.tmp 4432 AC29.tmp 5092 ACB6.tmp 4876 AD14.tmp 2588 AD91.tmp 4884 AE0E.tmp 2300 AE7B.tmp 4100 AEC9.tmp 1804 AF46.tmp 760 AFB3.tmp 2200 B030.tmp 552 B08E.tmp 2520 B0FC.tmp 4644 B1B7.tmp 2216 B224.tmp 4756 B2A1.tmp 3928 B2F0.tmp 1060 B37C.tmp 3208 B3F9.tmp 452 B467.tmp 3768 B4D4.tmp 5112 B541.tmp 3688 B5AF.tmp 2220 B5FD.tmp 3596 B66A.tmp 416 B6E7.tmp 216 B745.tmp 1272 B7D2.tmp 2868 B82F.tmp 2400 B86E.tmp 432 B8BC.tmp 3896 B91A.tmp 3268 B997.tmp 464 BA23.tmp 4320 BAA0.tmp 448 BB4C.tmp 836 BBAA.tmp 5068 BC37.tmp 4192 BCC3.tmp 5000 BD21.tmp 3924 BD8E.tmp 4476 BDEC.tmp 2256 BE3A.tmp 1584 BE98.tmp 912 BF05.tmp 1192 BF92.tmp 2924 C02E.tmp 2500 C07C.tmp 1780 C0CA.tmp 4580 C138.tmp 1664 C186.tmp 1960 C1F3.tmp 2068 C232.tmp 5016 C270.tmp 3304 C2AF.tmp 2288 C2ED.tmp 1832 C32C.tmp 1256 C36A.tmp 2336 C3B8.tmp 4668 C416.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C21D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B997.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 967A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1EC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3714.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A84C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1311.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 570F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 479E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A2E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A908.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B80B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7371.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D085.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D400.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F17F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4232 wrote to memory of 1680 4232 2026-05-16_254422413d8e2109a9143307f7d0f2d6_elex_mafia_stealc_tofsee.exe 83 PID 1680 wrote to memory of 684 1680 A92C.tmp 84 PID 684 wrote to memory of 4536 684 A9B8.tmp 85 PID 4536 wrote to memory of 4920 4536 AA64.tmp 86 PID 4920 wrote to memory of 4352 4920 AB2F.tmp 87 PID 4352 wrote to memory of 4432 4352 ABAC.tmp 88 PID 4432 wrote to memory of 5092 4432 AC29.tmp 89 PID 5092 wrote to memory of 4876 5092 ACB6.tmp 90 PID 4876 wrote to memory of 2588 4876 AD14.tmp 91 PID 2588 wrote to memory of 4884 2588 AD91.tmp 92 PID 4884 wrote to memory of 2300 4884 AE0E.tmp 93 PID 2300 wrote to memory of 4100 2300 AE7B.tmp 94 PID 4100 wrote to memory of 1804 4100 AEC9.tmp 95 PID 1804 wrote to memory of 760 1804 AF46.tmp 96 PID 760 wrote to memory of 2200 760 AFB3.tmp 97 PID 2200 wrote to memory of 552 2200 B030.tmp 98 PID 552 wrote to memory of 2520 552 B08E.tmp 99 PID 2520 wrote to memory of 4644 2520 B0FC.tmp 100 PID 4644 wrote to memory of 2216 4644 B1B7.tmp 101 PID 2216 wrote to memory of 4756 2216 B224.tmp 102 PID 4756 wrote to memory of 3928 4756 B2A1.tmp 103 PID 3928 wrote to memory of 1060 3928 B2F0.tmp 104 PID 1060 wrote to memory of 3208 1060 B37C.tmp 105 PID 3208 wrote to memory of 452 3208 B3F9.tmp 106 PID 452 wrote to memory of 3768 452 B467.tmp 107 PID 3768 wrote to memory of 5112 3768 B4D4.tmp 108 PID 5112 wrote to memory of 3688 5112 B541.tmp 109 PID 3688 wrote to memory of 2220 3688 B5AF.tmp 110 PID 2220 wrote to memory of 3596 2220 B5FD.tmp 111 PID 3596 wrote to memory of 416 3596 B66A.tmp 112 PID 416 wrote to memory of 216 416 B6E7.tmp 113 PID 216 wrote to memory of 1272 216 B745.tmp 114 PID 1272 wrote to memory of 2868 1272 B7D2.tmp 115 PID 2868 wrote to memory of 2400 2868 B82F.tmp 116 PID 2400 wrote to memory of 432 2400 B86E.tmp 117 PID 432 wrote to memory of 3896 432 B8BC.tmp 118 PID 3896 wrote to memory of 3268 3896 B91A.tmp 119 PID 3268 wrote to memory of 464 3268 B997.tmp 120 PID 464 wrote to memory of 4320 464 BA23.tmp 121 PID 4320 wrote to memory of 448 4320 BAA0.tmp 122 PID 448 wrote to memory of 836 448 BB4C.tmp 123 PID 836 wrote to memory of 5068 836 BBAA.tmp 124 PID 5068 wrote to memory of 4192 5068 BC37.tmp 125 PID 4192 wrote to memory of 5000 4192 BCC3.tmp 126 PID 5000 wrote to memory of 3924 5000 BD21.tmp 127 PID 3924 wrote to memory of 4476 3924 BD8E.tmp 128 PID 4476 wrote to memory of 2256 4476 BDEC.tmp 129 PID 2256 wrote to memory of 1584 2256 BE3A.tmp 130 PID 1584 wrote to memory of 912 1584 BE98.tmp 131 PID 912 wrote to memory of 1192 912 BF05.tmp 132 PID 1192 wrote to memory of 2924 1192 BF92.tmp 133 PID 2924 wrote to memory of 2500 2924 C02E.tmp 134 PID 2500 wrote to memory of 1780 2500 C07C.tmp 135 PID 1780 wrote to memory of 4580 1780 C0CA.tmp 136 PID 4580 wrote to memory of 1664 4580 C138.tmp 137 PID 1664 wrote to memory of 1960 1664 C186.tmp 138 PID 1960 wrote to memory of 2068 1960 C1F3.tmp 139 PID 2068 wrote to memory of 5016 2068 C232.tmp 140 PID 5016 wrote to memory of 3304 5016 C270.tmp 141 PID 3304 wrote to memory of 2288 3304 C2AF.tmp 142 PID 2288 wrote to memory of 1832 2288 C2ED.tmp 143 PID 1832 wrote to memory of 1256 1832 C32C.tmp 144 PID 1256 wrote to memory of 2336 1256 C36A.tmp 145 PID 2336 wrote to memory of 4668 2336 C3B8.tmp 146
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-16_254422413d8e2109a9143307f7d0f2d6_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-16_254422413d8e2109a9143307f7d0f2d6_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\A92C.tmp"C:\Users\Admin\AppData\Local\Temp\A92C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"C:\Users\Admin\AppData\Local\Temp\A9B8.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\AA64.tmp"C:\Users\Admin\AppData\Local\Temp\AA64.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\AB2F.tmp"C:\Users\Admin\AppData\Local\Temp\AB2F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\ABAC.tmp"C:\Users\Admin\AppData\Local\Temp\ABAC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\AC29.tmp"C:\Users\Admin\AppData\Local\Temp\AC29.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\ACB6.tmp"C:\Users\Admin\AppData\Local\Temp\ACB6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\AD14.tmp"C:\Users\Admin\AppData\Local\Temp\AD14.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\AD91.tmp"C:\Users\Admin\AppData\Local\Temp\AD91.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\AE0E.tmp"C:\Users\Admin\AppData\Local\Temp\AE0E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\AE7B.tmp"C:\Users\Admin\AppData\Local\Temp\AE7B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\AEC9.tmp"C:\Users\Admin\AppData\Local\Temp\AEC9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\AF46.tmp"C:\Users\Admin\AppData\Local\Temp\AF46.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\B030.tmp"C:\Users\Admin\AppData\Local\Temp\B030.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\B08E.tmp"C:\Users\Admin\AppData\Local\Temp\B08E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\B0FC.tmp"C:\Users\Admin\AppData\Local\Temp\B0FC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\B1B7.tmp"C:\Users\Admin\AppData\Local\Temp\B1B7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\B224.tmp"C:\Users\Admin\AppData\Local\Temp\B224.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\B2A1.tmp"C:\Users\Admin\AppData\Local\Temp\B2A1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\B2F0.tmp"C:\Users\Admin\AppData\Local\Temp\B2F0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\B37C.tmp"C:\Users\Admin\AppData\Local\Temp\B37C.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\B3F9.tmp"C:\Users\Admin\AppData\Local\Temp\B3F9.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\B467.tmp"C:\Users\Admin\AppData\Local\Temp\B467.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\B4D4.tmp"C:\Users\Admin\AppData\Local\Temp\B4D4.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\B541.tmp"C:\Users\Admin\AppData\Local\Temp\B541.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\B5AF.tmp"C:\Users\Admin\AppData\Local\Temp\B5AF.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\B5FD.tmp"C:\Users\Admin\AppData\Local\Temp\B5FD.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\B66A.tmp"C:\Users\Admin\AppData\Local\Temp\B66A.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\B6E7.tmp"C:\Users\Admin\AppData\Local\Temp\B6E7.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\B745.tmp"C:\Users\Admin\AppData\Local\Temp\B745.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\B7D2.tmp"C:\Users\Admin\AppData\Local\Temp\B7D2.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\B82F.tmp"C:\Users\Admin\AppData\Local\Temp\B82F.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\B86E.tmp"C:\Users\Admin\AppData\Local\Temp\B86E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\B8BC.tmp"C:\Users\Admin\AppData\Local\Temp\B8BC.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\B91A.tmp"C:\Users\Admin\AppData\Local\Temp\B91A.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\B997.tmp"C:\Users\Admin\AppData\Local\Temp\B997.tmp"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\BA23.tmp"C:\Users\Admin\AppData\Local\Temp\BA23.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\BAA0.tmp"C:\Users\Admin\AppData\Local\Temp\BAA0.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\BB4C.tmp"C:\Users\Admin\AppData\Local\Temp\BB4C.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\BBAA.tmp"C:\Users\Admin\AppData\Local\Temp\BBAA.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\BC37.tmp"C:\Users\Admin\AppData\Local\Temp\BC37.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\BCC3.tmp"C:\Users\Admin\AppData\Local\Temp\BCC3.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\BD21.tmp"C:\Users\Admin\AppData\Local\Temp\BD21.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\BDEC.tmp"C:\Users\Admin\AppData\Local\Temp\BDEC.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\BE3A.tmp"C:\Users\Admin\AppData\Local\Temp\BE3A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\BE98.tmp"C:\Users\Admin\AppData\Local\Temp\BE98.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\BF05.tmp"C:\Users\Admin\AppData\Local\Temp\BF05.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\BF92.tmp"C:\Users\Admin\AppData\Local\Temp\BF92.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\C02E.tmp"C:\Users\Admin\AppData\Local\Temp\C02E.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\C07C.tmp"C:\Users\Admin\AppData\Local\Temp\C07C.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\C0CA.tmp"C:\Users\Admin\AppData\Local\Temp\C0CA.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\C138.tmp"C:\Users\Admin\AppData\Local\Temp\C138.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\C186.tmp"C:\Users\Admin\AppData\Local\Temp\C186.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\C1F3.tmp"C:\Users\Admin\AppData\Local\Temp\C1F3.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\C232.tmp"C:\Users\Admin\AppData\Local\Temp\C232.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\C270.tmp"C:\Users\Admin\AppData\Local\Temp\C270.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\C2AF.tmp"C:\Users\Admin\AppData\Local\Temp\C2AF.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\C2ED.tmp"C:\Users\Admin\AppData\Local\Temp\C2ED.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\C32C.tmp"C:\Users\Admin\AppData\Local\Temp\C32C.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\C36A.tmp"C:\Users\Admin\AppData\Local\Temp\C36A.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\C3B8.tmp"C:\Users\Admin\AppData\Local\Temp\C3B8.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\C416.tmp"C:\Users\Admin\AppData\Local\Temp\C416.tmp"65⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\C464.tmp"C:\Users\Admin\AppData\Local\Temp\C464.tmp"66⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\C4E1.tmp"C:\Users\Admin\AppData\Local\Temp\C4E1.tmp"67⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\C53F.tmp"C:\Users\Admin\AppData\Local\Temp\C53F.tmp"68⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\C5AC.tmp"C:\Users\Admin\AppData\Local\Temp\C5AC.tmp"69⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\C639.tmp"C:\Users\Admin\AppData\Local\Temp\C639.tmp"70⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\C6B6.tmp"C:\Users\Admin\AppData\Local\Temp\C6B6.tmp"71⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\C723.tmp"C:\Users\Admin\AppData\Local\Temp\C723.tmp"72⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"73⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\C80E.tmp"C:\Users\Admin\AppData\Local\Temp\C80E.tmp"74⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\C87B.tmp"C:\Users\Admin\AppData\Local\Temp\C87B.tmp"75⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\C8E9.tmp"C:\Users\Admin\AppData\Local\Temp\C8E9.tmp"76⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\C937.tmp"C:\Users\Admin\AppData\Local\Temp\C937.tmp"77⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\C994.tmp"C:\Users\Admin\AppData\Local\Temp\C994.tmp"78⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\CA11.tmp"C:\Users\Admin\AppData\Local\Temp\CA11.tmp"79⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\CA9E.tmp"C:\Users\Admin\AppData\Local\Temp\CA9E.tmp"80⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"C:\Users\Admin\AppData\Local\Temp\CB3A.tmp"81⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\CB88.tmp"C:\Users\Admin\AppData\Local\Temp\CB88.tmp"82⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"83⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"84⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\CC92.tmp"C:\Users\Admin\AppData\Local\Temp\CC92.tmp"85⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"86⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"87⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"88⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"89⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\CE48.tmp"C:\Users\Admin\AppData\Local\Temp\CE48.tmp"90⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\CEB5.tmp"C:\Users\Admin\AppData\Local\Temp\CEB5.tmp"91⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\CF22.tmp"C:\Users\Admin\AppData\Local\Temp\CF22.tmp"92⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\CF80.tmp"C:\Users\Admin\AppData\Local\Temp\CF80.tmp"93⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\CFED.tmp"C:\Users\Admin\AppData\Local\Temp\CFED.tmp"94⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\D05B.tmp"C:\Users\Admin\AppData\Local\Temp\D05B.tmp"95⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\D0A9.tmp"C:\Users\Admin\AppData\Local\Temp\D0A9.tmp"96⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\D0F7.tmp"C:\Users\Admin\AppData\Local\Temp\D0F7.tmp"97⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\D164.tmp"C:\Users\Admin\AppData\Local\Temp\D164.tmp"98⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\D1C2.tmp"C:\Users\Admin\AppData\Local\Temp\D1C2.tmp"99⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\D230.tmp"C:\Users\Admin\AppData\Local\Temp\D230.tmp"100⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\D27E.tmp"C:\Users\Admin\AppData\Local\Temp\D27E.tmp"101⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"C:\Users\Admin\AppData\Local\Temp\D2DB.tmp"102⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\D32A.tmp"C:\Users\Admin\AppData\Local\Temp\D32A.tmp"103⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\D378.tmp"C:\Users\Admin\AppData\Local\Temp\D378.tmp"104⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"C:\Users\Admin\AppData\Local\Temp\D3D5.tmp"105⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\D443.tmp"C:\Users\Admin\AppData\Local\Temp\D443.tmp"106⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"C:\Users\Admin\AppData\Local\Temp\D4B0.tmp"107⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\D51E.tmp"C:\Users\Admin\AppData\Local\Temp\D51E.tmp"108⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\D56C.tmp"C:\Users\Admin\AppData\Local\Temp\D56C.tmp"109⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\D5BA.tmp"C:\Users\Admin\AppData\Local\Temp\D5BA.tmp"110⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\D608.tmp"C:\Users\Admin\AppData\Local\Temp\D608.tmp"111⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\D656.tmp"C:\Users\Admin\AppData\Local\Temp\D656.tmp"112⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\D6C3.tmp"C:\Users\Admin\AppData\Local\Temp\D6C3.tmp"113⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\D731.tmp"C:\Users\Admin\AppData\Local\Temp\D731.tmp"114⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\D79E.tmp"C:\Users\Admin\AppData\Local\Temp\D79E.tmp"115⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\D80C.tmp"C:\Users\Admin\AppData\Local\Temp\D80C.tmp"116⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\D879.tmp"C:\Users\Admin\AppData\Local\Temp\D879.tmp"117⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\D8F6.tmp"C:\Users\Admin\AppData\Local\Temp\D8F6.tmp"118⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\D944.tmp"C:\Users\Admin\AppData\Local\Temp\D944.tmp"119⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\D992.tmp"C:\Users\Admin\AppData\Local\Temp\D992.tmp"120⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\D9E0.tmp"C:\Users\Admin\AppData\Local\Temp\D9E0.tmp"121⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\DA2E.tmp"C:\Users\Admin\AppData\Local\Temp\DA2E.tmp"122⤵PID:4992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-