Analysis
- max time kernel
148s - max time network
99s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/05/2026, 11:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-19_73095ece9e8098e53e27477d26db60d7_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-19_73095ece9e8098e53e27477d26db60d7_elex_mafia_stealc_tofsee.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-05-19_73095ece9e8098e53e27477d26db60d7_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260519-n29fcabs4y
- SHA256 cf5d8eddd457e5379abc14077dd91140f83691a03a118c00844d8739c998649b
- MD5 73095ece9e8098e53e27477d26db60d7
- SHA1 ebcaea94ef2ce748dfccb9ddb01fd08ecfa3e6e7
- SHA512 34b9d4e4a52cdeccd364e44ddd2be3d1dd66297f4d0207eda374684525e46fa86c1061e28121f9931fe5e5c5d1359937a31a08796143f2b86601df57f3c9455e
- SSDEEP 12288:NU5rCOTeijaU7DUY3NC9W9JPDB4lPTZwlH:NUQOJjaKE9wJtqPTSlH
- TLSH T169B4F11AB685C133E59202310BDADBB2293EBC34572694C33BD0A66E6FB56E1D375343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4256 C340.tmp 5048 C38E.tmp 5056 C3DC.tmp 5108 C42B.tmp 556 C479.tmp 3684 C4D6.tmp 6088 C582.tmp 5172 C5F0.tmp 1716 C64D.tmp 1036 C6AB.tmp 664 C709.tmp 3876 C757.tmp 4532 C7A5.tmp 2036 C813.tmp 1912 C880.tmp 1732 C8DE.tmp 1328 C93B.tmp 2684 C9A9.tmp 2496 CA26.tmp 5524 CA84.tmp 2936 CB01.tmp 6044 CB4F.tmp 5548 CBAC.tmp 2772 CC1A.tmp 2668 CC78.tmp 4460 CCE5.tmp 3356 CD52.tmp 688 CDC0.tmp 1680 CE1D.tmp 4080 CE6C.tmp 5900 CEE9.tmp 2944 CF46.tmp 4468 CFC3.tmp 4868 D021.tmp 5288 D07F.tmp 4216 D0CD.tmp 2956 D13A.tmp 2212 D188.tmp 6000 D1E6.tmp 5612 D234.tmp 4856 D292.tmp 5492 D2F0.tmp 2676 D34E.tmp 2980 D39C.tmp 1696 D3EA.tmp 5512 D448.tmp 4296 D4A5.tmp 5424 D503.tmp 5420 D570.tmp 5456 D5CE.tmp 2500 D62C.tmp 4836 D68A.tmp 4452 D6D8.tmp 1592 D745.tmp 5684 D793.tmp 1648 D801.tmp 1656 D86E.tmp 5736 D8DB.tmp 3436 D949.tmp 3368 D9D5.tmp 5316 DA33.tmp 652 DAC0.tmp 1504 DB0E.tmp 4776 DB7B.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E460.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2532.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC61.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 606.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B10B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B90A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F01D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2093.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 599.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8930.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2476.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5743.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B4A.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3976 wrote to memory of 4256 3976 2026-05-19_73095ece9e8098e53e27477d26db60d7_elex_mafia_stealc_tofsee.exe 80 PID 4256 wrote to memory of 5048 4256 C340.tmp 81 PID 5048 wrote to memory of 5056 5048 C38E.tmp 82 PID 5056 wrote to memory of 5108 5056 C3DC.tmp 83 PID 5108 wrote to memory of 556 5108 C42B.tmp 84 PID 556 wrote to memory of 3684 556 C479.tmp 85 PID 3684 wrote to memory of 6088 3684 C4D6.tmp 86 PID 6088 wrote to memory of 5172 6088 C582.tmp 87 PID 5172 wrote to memory of 1716 5172 C5F0.tmp 88 PID 1716 wrote to memory of 1036 1716 C64D.tmp 89 PID 1036 wrote to memory of 664 1036 C6AB.tmp 90 PID 664 wrote to memory of 3876 664 C709.tmp 91 PID 3876 wrote to memory of 4532 3876 C757.tmp 92 PID 4532 wrote to memory of 2036 4532 C7A5.tmp 93 PID 2036 wrote to memory of 1912 2036 C813.tmp 94 PID 1912 wrote to memory of 1732 1912 C880.tmp 95 PID 1732 wrote to memory of 1328 1732 C8DE.tmp 96 PID 1328 wrote to memory of 2684 1328 C93B.tmp 97 PID 2684 wrote to memory of 2496 2684 C9A9.tmp 98 PID 2496 wrote to memory of 5524 2496 CA26.tmp 99 PID 5524 wrote to memory of 2936 5524 CA84.tmp 100 PID 2936 wrote to memory of 6044 2936 CB01.tmp 101 PID 6044 wrote to memory of 5548 6044 CB4F.tmp 102 PID 5548 wrote to memory of 2772 5548 CBAC.tmp 103 PID 2772 wrote to memory of 2668 2772 CC1A.tmp 104 PID 2668 wrote to memory of 4460 2668 CC78.tmp 105 PID 4460 wrote to memory of 3356 4460 CCE5.tmp 106 PID 3356 wrote to memory of 688 3356 CD52.tmp 107 PID 688 wrote to memory of 1680 688 CDC0.tmp 108 PID 1680 wrote to memory of 4080 1680 CE1D.tmp 109 PID 4080 wrote to memory of 5900 4080 CE6C.tmp 110 PID 5900 wrote to memory of 2944 5900 CEE9.tmp 111 PID 2944 wrote to memory of 4468 2944 CF46.tmp 112 PID 4468 wrote to memory of 4868 4468 CFC3.tmp 113 PID 4868 wrote to memory of 5288 4868 D021.tmp 114 PID 5288 wrote to memory of 4216 5288 D07F.tmp 115 PID 4216 wrote to memory of 2956 4216 D0CD.tmp 116 PID 2956 wrote to memory of 2212 2956 D13A.tmp 117 PID 2212 wrote to memory of 6000 2212 D188.tmp 118 PID 6000 wrote to memory of 5612 6000 D1E6.tmp 119 PID 5612 wrote to memory of 4856 5612 D234.tmp 120 PID 4856 wrote to memory of 5492 4856 D292.tmp 121 PID 5492 wrote to memory of 2676 5492 D2F0.tmp 122 PID 2676 wrote to memory of 2980 2676 D34E.tmp 123 PID 2980 wrote to memory of 1696 2980 D39C.tmp 124 PID 1696 wrote to memory of 5512 1696 D3EA.tmp 125 PID 5512 wrote to memory of 4296 5512 D448.tmp 126 PID 4296 wrote to memory of 5424 4296 D4A5.tmp 127 PID 5424 wrote to memory of 5420 5424 D503.tmp 128 PID 5420 wrote to memory of 5456 5420 D570.tmp 129 PID 5456 wrote to memory of 2500 5456 D5CE.tmp 130 PID 2500 wrote to memory of 4836 2500 D62C.tmp 131 PID 4836 wrote to memory of 4452 4836 D68A.tmp 132 PID 4452 wrote to memory of 1592 4452 D6D8.tmp 133 PID 1592 wrote to memory of 5684 1592 D745.tmp 134 PID 5684 wrote to memory of 1648 5684 D793.tmp 135 PID 1648 wrote to memory of 1656 1648 D801.tmp 136 PID 1656 wrote to memory of 5736 1656 D86E.tmp 137 PID 5736 wrote to memory of 3436 5736 D8DB.tmp 138 PID 3436 wrote to memory of 3368 3436 D949.tmp 139 PID 3368 wrote to memory of 5316 3368 D9D5.tmp 140 PID 5316 wrote to memory of 652 5316 DA33.tmp 141 PID 652 wrote to memory of 1504 652 DAC0.tmp 142 PID 1504 wrote to memory of 4776 1504 DB0E.tmp 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-19_73095ece9e8098e53e27477d26db60d7_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-19_73095ece9e8098e53e27477d26db60d7_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\C38E.tmp"C:\Users\Admin\AppData\Local\Temp\C38E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"C:\Users\Admin\AppData\Local\Temp\C4D6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\C582.tmp"C:\Users\Admin\AppData\Local\Temp\C582.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6088 -
C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"C:\Users\Admin\AppData\Local\Temp\C5F0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\C813.tmp"C:\Users\Admin\AppData\Local\Temp\C813.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\C880.tmp"C:\Users\Admin\AppData\Local\Temp\C880.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"C:\Users\Admin\AppData\Local\Temp\C8DE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\C93B.tmp"C:\Users\Admin\AppData\Local\Temp\C93B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\CB01.tmp"C:\Users\Admin\AppData\Local\Temp\CB01.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"C:\Users\Admin\AppData\Local\Temp\CB4F.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"C:\Users\Admin\AppData\Local\Temp\CBAC.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\CC78.tmp"C:\Users\Admin\AppData\Local\Temp\CC78.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\CD52.tmp"C:\Users\Admin\AppData\Local\Temp\CD52.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"C:\Users\Admin\AppData\Local\Temp\CEE9.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\D07F.tmp"C:\Users\Admin\AppData\Local\Temp\D07F.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5288 -
C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"C:\Users\Admin\AppData\Local\Temp\D0CD.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\D188.tmp"C:\Users\Admin\AppData\Local\Temp\D188.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6000 -
C:\Users\Admin\AppData\Local\Temp\D234.tmp"C:\Users\Admin\AppData\Local\Temp\D234.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\D39C.tmp"C:\Users\Admin\AppData\Local\Temp\D39C.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\D448.tmp"C:\Users\Admin\AppData\Local\Temp\D448.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\D503.tmp"C:\Users\Admin\AppData\Local\Temp\D503.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\D570.tmp"C:\Users\Admin\AppData\Local\Temp\D570.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"C:\Users\Admin\AppData\Local\Temp\D5CE.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\D62C.tmp"C:\Users\Admin\AppData\Local\Temp\D62C.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"C:\Users\Admin\AppData\Local\Temp\D6D8.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\D745.tmp"C:\Users\Admin\AppData\Local\Temp\D745.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\D793.tmp"C:\Users\Admin\AppData\Local\Temp\D793.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Users\Admin\AppData\Local\Temp\D801.tmp"C:\Users\Admin\AppData\Local\Temp\D801.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\D86E.tmp"C:\Users\Admin\AppData\Local\Temp\D86E.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\D949.tmp"C:\Users\Admin\AppData\Local\Temp\D949.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\DA33.tmp"C:\Users\Admin\AppData\Local\Temp\DA33.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"C:\Users\Admin\AppData\Local\Temp\DAC0.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"C:\Users\Admin\AppData\Local\Temp\DB0E.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"C:\Users\Admin\AppData\Local\Temp\DB7B.tmp"65⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"C:\Users\Admin\AppData\Local\Temp\DBD9.tmp"66⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\DC27.tmp"C:\Users\Admin\AppData\Local\Temp\DC27.tmp"67⤵PID:784
-
C:\Users\Admin\AppData\Local\Temp\DC85.tmp"C:\Users\Admin\AppData\Local\Temp\DC85.tmp"68⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"C:\Users\Admin\AppData\Local\Temp\DCF2.tmp"69⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\DD50.tmp"C:\Users\Admin\AppData\Local\Temp\DD50.tmp"70⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"C:\Users\Admin\AppData\Local\Temp\DDBD.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"C:\Users\Admin\AppData\Local\Temp\DE2B.tmp"72⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:996 -
C:\Users\Admin\AppData\Local\Temp\DF06.tmp"C:\Users\Admin\AppData\Local\Temp\DF06.tmp"74⤵PID:5368
-
C:\Users\Admin\AppData\Local\Temp\DF73.tmp"C:\Users\Admin\AppData\Local\Temp\DF73.tmp"75⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"76⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\E03E.tmp"C:\Users\Admin\AppData\Local\Temp\E03E.tmp"77⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\E08C.tmp"C:\Users\Admin\AppData\Local\Temp\E08C.tmp"78⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"C:\Users\Admin\AppData\Local\Temp\E0DA.tmp"79⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\E128.tmp"C:\Users\Admin\AppData\Local\Temp\E128.tmp"80⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\E177.tmp"C:\Users\Admin\AppData\Local\Temp\E177.tmp"81⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"C:\Users\Admin\AppData\Local\Temp\E1C5.tmp"82⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\E213.tmp"C:\Users\Admin\AppData\Local\Temp\E213.tmp"83⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\E261.tmp"C:\Users\Admin\AppData\Local\Temp\E261.tmp"84⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"85⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\E31C.tmp"C:\Users\Admin\AppData\Local\Temp\E31C.tmp"86⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\E37A.tmp"C:\Users\Admin\AppData\Local\Temp\E37A.tmp"87⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"C:\Users\Admin\AppData\Local\Temp\E3C8.tmp"88⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\E426.tmp"C:\Users\Admin\AppData\Local\Temp\E426.tmp"89⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\E474.tmp"C:\Users\Admin\AppData\Local\Temp\E474.tmp"90⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"C:\Users\Admin\AppData\Local\Temp\E4C2.tmp"91⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"92⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"93⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"94⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\E61A.tmp"C:\Users\Admin\AppData\Local\Temp\E61A.tmp"95⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\E668.tmp"C:\Users\Admin\AppData\Local\Temp\E668.tmp"96⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"97⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\E704.tmp"C:\Users\Admin\AppData\Local\Temp\E704.tmp"98⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"99⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"100⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"101⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"102⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"103⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"104⤵PID:5184
-
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"105⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"106⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\EA41.tmp"C:\Users\Admin\AppData\Local\Temp\EA41.tmp"107⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"C:\Users\Admin\AppData\Local\Temp\EAAE.tmp"108⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"C:\Users\Admin\AppData\Local\Temp\EB3B.tmp"109⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"110⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"111⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\EC83.tmp"C:\Users\Admin\AppData\Local\Temp\EC83.tmp"112⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"C:\Users\Admin\AppData\Local\Temp\ECD1.tmp"113⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"C:\Users\Admin\AppData\Local\Temp\ED2F.tmp"114⤵PID:5432
-
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"115⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"C:\Users\Admin\AppData\Local\Temp\EDDA.tmp"116⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"117⤵PID:5168
-
C:\Users\Admin\AppData\Local\Temp\EE86.tmp"C:\Users\Admin\AppData\Local\Temp\EE86.tmp"118⤵PID:5308
-
C:\Users\Admin\AppData\Local\Temp\EF03.tmp"C:\Users\Admin\AppData\Local\Temp\EF03.tmp"119⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\EF80.tmp"C:\Users\Admin\AppData\Local\Temp\EF80.tmp"120⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\F01D.tmp"C:\Users\Admin\AppData\Local\Temp\F01D.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\F07A.tmp"C:\Users\Admin\AppData\Local\Temp\F07A.tmp"122⤵PID:5800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-