Analysis
- max time kernel
150s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/06/2026, 13:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-01_c00aba51b495f3fe41c8a180da9d3178_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-01_c00aba51b495f3fe41c8a180da9d3178_elex_mafia_stealc_tofsee.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-06-01_c00aba51b495f3fe41c8a180da9d3178_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260601-qef7dsfs3k
- SHA256 1eb8748bf19abdec494a45fba608804986362993bac6c6a79dcdb08e14fdf777
- MD5 c00aba51b495f3fe41c8a180da9d3178
- SHA1 343b080046b93c88eec69e5bc3b8e1a62a4e6611
- SHA512 efb73b25d0989ff965940bef46932522371c76acef292b86186538a3c9f2e14670c53991acda7e186751b2d60bdf6bdb357f79a45158f17e65ac8cd077534464
- SSDEEP 12288:NU5rCOTeij8lvL5S6QfmIYTQlchDq//DEG6AbTZwlH4Hp:NUQOJj6VSwdTQlchDq/77bTSlH4Hp
- TLSH T193B4F126B684C232E5D202710AD6EBA27A3B7D75572690C73790A63D2FB17E0D736307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4952 40BD.tmp 3180 412B.tmp 3712 41C7.tmp 4784 4273.tmp 3028 42D0.tmp 2448 433E.tmp 3412 43AB.tmp 1932 4409.tmp 4908 4476.tmp 4900 4513.tmp 484 4570.tmp 3256 45FD.tmp 3600 464B.tmp 5056 46B8.tmp 3440 4735.tmp 3748 4793.tmp 4024 482F.tmp 3192 48AC.tmp 5052 491A.tmp 1548 49B6.tmp 4640 4A14.tmp 2172 4A62.tmp 952 4ADF.tmp 3392 4B7B.tmp 1128 4BD9.tmp 3772 4C46.tmp 1376 4CF2.tmp 3992 4D8E.tmp 832 4DDD.tmp 2156 4E5A.tmp 4128 4EF6.tmp 2164 4F92.tmp 1896 4FE0.tmp 3336 502E.tmp 1512 509C.tmp 2772 50EA.tmp 2328 5157.tmp 1424 51A5.tmp 992 51F3.tmp 3432 5261.tmp 1664 52CE.tmp 4960 533C.tmp 2136 5399.tmp 2792 53F7.tmp 3564 5455.tmp 1052 54A3.tmp 1972 5510.tmp 4656 557E.tmp 4376 55DB.tmp 772 5658.tmp 2468 56B6.tmp 988 5704.tmp 4300 5772.tmp 1192 57C0.tmp 4164 580E.tmp 2600 586C.tmp 4008 58BA.tmp 5108 5908.tmp 676 5966.tmp 2692 59B4.tmp 4000 5A02.tmp 4776 5A50.tmp 1592 5AAE.tmp 4924 5B4A.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6695.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D29D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2560.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A35A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 899D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 966F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACE5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A30C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 819A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 846D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F680.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E50C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A80E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C772.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DADA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E039.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5078.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 356E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C46.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2128 wrote to memory of 4952 2128 2026-06-01_c00aba51b495f3fe41c8a180da9d3178_elex_mafia_stealc_tofsee.exe 80 PID 4952 wrote to memory of 3180 4952 40BD.tmp 81 PID 3180 wrote to memory of 3712 3180 412B.tmp 82 PID 3712 wrote to memory of 4784 3712 41C7.tmp 83 PID 4784 wrote to memory of 3028 4784 4273.tmp 84 PID 3028 wrote to memory of 2448 3028 42D0.tmp 85 PID 2448 wrote to memory of 3412 2448 433E.tmp 86 PID 3412 wrote to memory of 1932 3412 43AB.tmp 87 PID 1932 wrote to memory of 4908 1932 4409.tmp 88 PID 4908 wrote to memory of 4900 4908 4476.tmp 89 PID 4900 wrote to memory of 484 4900 4513.tmp 90 PID 484 wrote to memory of 3256 484 4570.tmp 91 PID 3256 wrote to memory of 3600 3256 45FD.tmp 92 PID 3600 wrote to memory of 5056 3600 464B.tmp 93 PID 5056 wrote to memory of 3440 5056 46B8.tmp 94 PID 3440 wrote to memory of 3748 3440 4735.tmp 95 PID 3748 wrote to memory of 4024 3748 4793.tmp 96 PID 4024 wrote to memory of 3192 4024 482F.tmp 97 PID 3192 wrote to memory of 5052 3192 48AC.tmp 98 PID 5052 wrote to memory of 1548 5052 491A.tmp 99 PID 1548 wrote to memory of 4640 1548 49B6.tmp 100 PID 4640 wrote to memory of 2172 4640 4A14.tmp 101 PID 2172 wrote to memory of 952 2172 4A62.tmp 102 PID 952 wrote to memory of 3392 952 4ADF.tmp 103 PID 3392 wrote to memory of 1128 3392 4B7B.tmp 104 PID 1128 wrote to memory of 3772 1128 4BD9.tmp 105 PID 3772 wrote to memory of 1376 3772 4C46.tmp 106 PID 1376 wrote to memory of 3992 1376 4CF2.tmp 107 PID 3992 wrote to memory of 832 3992 4D8E.tmp 108 PID 832 wrote to memory of 2156 832 4DDD.tmp 109 PID 2156 wrote to memory of 4128 2156 4E5A.tmp 110 PID 4128 wrote to memory of 2164 4128 4EF6.tmp 111 PID 2164 wrote to memory of 1896 2164 4F92.tmp 112 PID 1896 wrote to memory of 3336 1896 4FE0.tmp 113 PID 3336 wrote to memory of 1512 3336 502E.tmp 114 PID 1512 wrote to memory of 2772 1512 509C.tmp 115 PID 2772 wrote to memory of 2328 2772 50EA.tmp 116 PID 2328 wrote to memory of 1424 2328 5157.tmp 117 PID 1424 wrote to memory of 992 1424 51A5.tmp 118 PID 992 wrote to memory of 3432 992 51F3.tmp 119 PID 3432 wrote to memory of 1664 3432 5261.tmp 120 PID 1664 wrote to memory of 4960 1664 52CE.tmp 121 PID 4960 wrote to memory of 2136 4960 533C.tmp 122 PID 2136 wrote to memory of 2792 2136 5399.tmp 123 PID 2792 wrote to memory of 3564 2792 53F7.tmp 124 PID 3564 wrote to memory of 1052 3564 5455.tmp 125 PID 1052 wrote to memory of 1972 1052 54A3.tmp 126 PID 1972 wrote to memory of 4656 1972 5510.tmp 127 PID 4656 wrote to memory of 4376 4656 557E.tmp 128 PID 4376 wrote to memory of 772 4376 55DB.tmp 129 PID 772 wrote to memory of 2468 772 5658.tmp 130 PID 2468 wrote to memory of 988 2468 56B6.tmp 131 PID 988 wrote to memory of 4300 988 5704.tmp 132 PID 4300 wrote to memory of 1192 4300 5772.tmp 133 PID 1192 wrote to memory of 4164 1192 57C0.tmp 134 PID 4164 wrote to memory of 2600 4164 580E.tmp 135 PID 2600 wrote to memory of 4008 2600 586C.tmp 136 PID 4008 wrote to memory of 5108 4008 58BA.tmp 137 PID 5108 wrote to memory of 676 5108 5908.tmp 138 PID 676 wrote to memory of 2692 676 5966.tmp 139 PID 2692 wrote to memory of 4000 2692 59B4.tmp 140 PID 4000 wrote to memory of 4776 4000 5A02.tmp 141 PID 4776 wrote to memory of 1592 4776 5A50.tmp 142 PID 4644 wrote to memory of 4924 4644 5AFC.tmp 144
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-01_c00aba51b495f3fe41c8a180da9d3178_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-01_c00aba51b495f3fe41c8a180da9d3178_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\40BD.tmp"C:\Users\Admin\AppData\Local\Temp\40BD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\412B.tmp"C:\Users\Admin\AppData\Local\Temp\412B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\41C7.tmp"C:\Users\Admin\AppData\Local\Temp\41C7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\4273.tmp"C:\Users\Admin\AppData\Local\Temp\4273.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\42D0.tmp"C:\Users\Admin\AppData\Local\Temp\42D0.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\433E.tmp"C:\Users\Admin\AppData\Local\Temp\433E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\43AB.tmp"C:\Users\Admin\AppData\Local\Temp\43AB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\4476.tmp"C:\Users\Admin\AppData\Local\Temp\4476.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\4513.tmp"C:\Users\Admin\AppData\Local\Temp\4513.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\4570.tmp"C:\Users\Admin\AppData\Local\Temp\4570.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\45FD.tmp"C:\Users\Admin\AppData\Local\Temp\45FD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\464B.tmp"C:\Users\Admin\AppData\Local\Temp\464B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\46B8.tmp"C:\Users\Admin\AppData\Local\Temp\46B8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\4735.tmp"C:\Users\Admin\AppData\Local\Temp\4735.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\4793.tmp"C:\Users\Admin\AppData\Local\Temp\4793.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\482F.tmp"C:\Users\Admin\AppData\Local\Temp\482F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\48AC.tmp"C:\Users\Admin\AppData\Local\Temp\48AC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\491A.tmp"C:\Users\Admin\AppData\Local\Temp\491A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\49B6.tmp"C:\Users\Admin\AppData\Local\Temp\49B6.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\4A14.tmp"C:\Users\Admin\AppData\Local\Temp\4A14.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\4A62.tmp"C:\Users\Admin\AppData\Local\Temp\4A62.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\4ADF.tmp"C:\Users\Admin\AppData\Local\Temp\4ADF.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\4C46.tmp"C:\Users\Admin\AppData\Local\Temp\4C46.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"C:\Users\Admin\AppData\Local\Temp\4CF2.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"C:\Users\Admin\AppData\Local\Temp\4DDD.tmp"30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"C:\Users\Admin\AppData\Local\Temp\4EF6.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\4F92.tmp"C:\Users\Admin\AppData\Local\Temp\4F92.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"C:\Users\Admin\AppData\Local\Temp\4FE0.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\502E.tmp"C:\Users\Admin\AppData\Local\Temp\502E.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\509C.tmp"C:\Users\Admin\AppData\Local\Temp\509C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\50EA.tmp"C:\Users\Admin\AppData\Local\Temp\50EA.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\5157.tmp"C:\Users\Admin\AppData\Local\Temp\5157.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\51A5.tmp"C:\Users\Admin\AppData\Local\Temp\51A5.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\51F3.tmp"C:\Users\Admin\AppData\Local\Temp\51F3.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\5261.tmp"C:\Users\Admin\AppData\Local\Temp\5261.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\52CE.tmp"C:\Users\Admin\AppData\Local\Temp\52CE.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\533C.tmp"C:\Users\Admin\AppData\Local\Temp\533C.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\5399.tmp"C:\Users\Admin\AppData\Local\Temp\5399.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\53F7.tmp"C:\Users\Admin\AppData\Local\Temp\53F7.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\5455.tmp"C:\Users\Admin\AppData\Local\Temp\5455.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\54A3.tmp"C:\Users\Admin\AppData\Local\Temp\54A3.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\5510.tmp"C:\Users\Admin\AppData\Local\Temp\5510.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\557E.tmp"C:\Users\Admin\AppData\Local\Temp\557E.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\55DB.tmp"C:\Users\Admin\AppData\Local\Temp\55DB.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\5658.tmp"C:\Users\Admin\AppData\Local\Temp\5658.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\56B6.tmp"C:\Users\Admin\AppData\Local\Temp\56B6.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\5704.tmp"C:\Users\Admin\AppData\Local\Temp\5704.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\5772.tmp"C:\Users\Admin\AppData\Local\Temp\5772.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\57C0.tmp"C:\Users\Admin\AppData\Local\Temp\57C0.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\580E.tmp"C:\Users\Admin\AppData\Local\Temp\580E.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\586C.tmp"C:\Users\Admin\AppData\Local\Temp\586C.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\5908.tmp"C:\Users\Admin\AppData\Local\Temp\5908.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\59B4.tmp"C:\Users\Admin\AppData\Local\Temp\59B4.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"64⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"65⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"66⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"67⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\5C15.tmp"C:\Users\Admin\AppData\Local\Temp\5C15.tmp"68⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\5C73.tmp"C:\Users\Admin\AppData\Local\Temp\5C73.tmp"69⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\5CC1.tmp"C:\Users\Admin\AppData\Local\Temp\5CC1.tmp"70⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\5D0F.tmp"C:\Users\Admin\AppData\Local\Temp\5D0F.tmp"71⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"C:\Users\Admin\AppData\Local\Temp\5D5D.tmp"72⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"C:\Users\Admin\AppData\Local\Temp\5DCB.tmp"73⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\5E19.tmp"C:\Users\Admin\AppData\Local\Temp\5E19.tmp"74⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\5E67.tmp"C:\Users\Admin\AppData\Local\Temp\5E67.tmp"75⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"76⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\5F22.tmp"C:\Users\Admin\AppData\Local\Temp\5F22.tmp"77⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\5F71.tmp"C:\Users\Admin\AppData\Local\Temp\5F71.tmp"78⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"C:\Users\Admin\AppData\Local\Temp\5FDE.tmp"79⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"80⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\607A.tmp"C:\Users\Admin\AppData\Local\Temp\607A.tmp"81⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\60C8.tmp"C:\Users\Admin\AppData\Local\Temp\60C8.tmp"82⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\6126.tmp"C:\Users\Admin\AppData\Local\Temp\6126.tmp"83⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\6184.tmp"C:\Users\Admin\AppData\Local\Temp\6184.tmp"84⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\61D2.tmp"C:\Users\Admin\AppData\Local\Temp\61D2.tmp"85⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\6230.tmp"C:\Users\Admin\AppData\Local\Temp\6230.tmp"86⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\629D.tmp"C:\Users\Admin\AppData\Local\Temp\629D.tmp"87⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\62FB.tmp"C:\Users\Admin\AppData\Local\Temp\62FB.tmp"88⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\6359.tmp"C:\Users\Admin\AppData\Local\Temp\6359.tmp"89⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\63A7.tmp"C:\Users\Admin\AppData\Local\Temp\63A7.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\6404.tmp"C:\Users\Admin\AppData\Local\Temp\6404.tmp"91⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\6453.tmp"C:\Users\Admin\AppData\Local\Temp\6453.tmp"92⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\64A1.tmp"C:\Users\Admin\AppData\Local\Temp\64A1.tmp"93⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\650E.tmp"C:\Users\Admin\AppData\Local\Temp\650E.tmp"94⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\656C.tmp"C:\Users\Admin\AppData\Local\Temp\656C.tmp"95⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\65D9.tmp"C:\Users\Admin\AppData\Local\Temp\65D9.tmp"96⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\6647.tmp"C:\Users\Admin\AppData\Local\Temp\6647.tmp"97⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\6695.tmp"C:\Users\Admin\AppData\Local\Temp\6695.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:240 -
C:\Users\Admin\AppData\Local\Temp\66E3.tmp"C:\Users\Admin\AppData\Local\Temp\66E3.tmp"99⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\6731.tmp"C:\Users\Admin\AppData\Local\Temp\6731.tmp"100⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\679E.tmp"C:\Users\Admin\AppData\Local\Temp\679E.tmp"101⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\680C.tmp"C:\Users\Admin\AppData\Local\Temp\680C.tmp"102⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\6869.tmp"C:\Users\Admin\AppData\Local\Temp\6869.tmp"103⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\68B8.tmp"C:\Users\Admin\AppData\Local\Temp\68B8.tmp"104⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\6925.tmp"C:\Users\Admin\AppData\Local\Temp\6925.tmp"105⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\6983.tmp"C:\Users\Admin\AppData\Local\Temp\6983.tmp"106⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\69F0.tmp"C:\Users\Admin\AppData\Local\Temp\69F0.tmp"107⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"C:\Users\Admin\AppData\Local\Temp\6A3E.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"109⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\6B09.tmp"C:\Users\Admin\AppData\Local\Temp\6B09.tmp"110⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\6B57.tmp"C:\Users\Admin\AppData\Local\Temp\6B57.tmp"111⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\6BC5.tmp"C:\Users\Admin\AppData\Local\Temp\6BC5.tmp"112⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\6C23.tmp"C:\Users\Admin\AppData\Local\Temp\6C23.tmp"113⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\6C71.tmp"C:\Users\Admin\AppData\Local\Temp\6C71.tmp"114⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"115⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"C:\Users\Admin\AppData\Local\Temp\6D2C.tmp"116⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"117⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\6E26.tmp"C:\Users\Admin\AppData\Local\Temp\6E26.tmp"118⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\6E84.tmp"C:\Users\Admin\AppData\Local\Temp\6E84.tmp"119⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"C:\Users\Admin\AppData\Local\Temp\6EE2.tmp"120⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"C:\Users\Admin\AppData\Local\Temp\6F3F.tmp"121⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\6FAD.tmp"C:\Users\Admin\AppData\Local\Temp\6FAD.tmp"122⤵PID:4172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-