Analysis
- max time kernel
150s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-29_2f7ad8b280d4cc6d867bd4180aee6e76_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_2f7ad8b280d4cc6d867bd4180aee6e76_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-29_2f7ad8b280d4cc6d867bd4180aee6e76_elex_mafia_stealc_tofsee.exe
- Size 505KB
- Sample260730-cd967abl5v
- SHA256 548285bdcac13b8fd1f8307a155e438cc3caaa5a46a879613add628aac8c0fc0
- MD5 2f7ad8b280d4cc6d867bd4180aee6e76
- SHA1 99cac86ad376e08048b7173bfd63f38213f57c56
- SHA512 fc5249994c1fce2208d85c33c8042226dd177c72a15dcf0da9c33bc49f7332e8b1a8a1bf4603d61b06abca4f202d091fa643d1b309caebd553526e4f0b46ec9c
- SSDEEP 12288:NU5rCOTeijtzmw4jEJ2YXYBCXgGe9TZwlH:NUQOJjnvQ3Sg79TSlH
- TLSH T152B4F125B641C132E58302311AEAEBE16A3BBC35572660C37B94636D2FB53E1E779307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3640 3EAA.tmp 6080 3F27.tmp 6044 3FD3.tmp 1820 405F.tmp 3420 40DC.tmp 5884 4179.tmp 4712 4215.tmp 1744 42E0.tmp 2600 435D.tmp 3224 4419.tmp 1232 44B5.tmp 2340 4532.tmp 2768 45CE.tmp 5104 465B.tmp 5072 46D8.tmp 5736 4755.tmp 2072 4820.tmp 3720 48DB.tmp 2788 4978.tmp 1952 4A33.tmp 1784 4AA0.tmp 5320 4B0E.tmp 2064 4B7B.tmp 832 4C08.tmp 1036 4C94.tmp 3096 4D40.tmp 2796 4DCD.tmp 2156 4E5A.tmp 1892 4F05.tmp 3424 4FC1.tmp 5652 505D.tmp 5236 50F9.tmp 5516 5186.tmp 5284 51D4.tmp 2708 5232.tmp 4516 5280.tmp 5452 52CE.tmp 3572 532C.tmp 2732 537A.tmp 3512 53C8.tmp 4880 5416.tmp 5480 5474.tmp 5276 54D2.tmp 1992 5530.tmp 5600 557E.tmp 1364 55DB.tmp 892 562A.tmp 2964 5678.tmp 312 56C6.tmp 1248 5724.tmp 5440 5772.tmp 4000 57C0.tmp 3312 580E.tmp 1948 585C.tmp 6008 58AA.tmp 5980 58F8.tmp 5896 5946.tmp 4920 5995.tmp 2380 5A02.tmp 5944 5A50.tmp 3288 5A9E.tmp 4176 5AEC.tmp 5484 5B3A.tmp 4044 5B89.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C270.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8316.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 623F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E7CB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5995.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 942D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A39E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 585C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C81D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7768.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7035.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 700B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E62.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4636 wrote to memory of 3640 4636 2026-07-29_2f7ad8b280d4cc6d867bd4180aee6e76_elex_mafia_stealc_tofsee.exe 85 PID 3640 wrote to memory of 6080 3640 3EAA.tmp 86 PID 6080 wrote to memory of 6044 6080 3F27.tmp 87 PID 6044 wrote to memory of 1820 6044 3FD3.tmp 88 PID 1820 wrote to memory of 3420 1820 405F.tmp 89 PID 3420 wrote to memory of 5884 3420 40DC.tmp 90 PID 5884 wrote to memory of 4712 5884 4179.tmp 91 PID 4712 wrote to memory of 1744 4712 4215.tmp 92 PID 1744 wrote to memory of 2600 1744 42E0.tmp 93 PID 2600 wrote to memory of 3224 2600 435D.tmp 94 PID 3224 wrote to memory of 1232 3224 4419.tmp 95 PID 1232 wrote to memory of 2340 1232 44B5.tmp 96 PID 2340 wrote to memory of 2768 2340 4532.tmp 97 PID 2768 wrote to memory of 5104 2768 45CE.tmp 98 PID 5104 wrote to memory of 5072 5104 465B.tmp 99 PID 5072 wrote to memory of 5736 5072 46D8.tmp 102 PID 5736 wrote to memory of 2072 5736 4755.tmp 103 PID 2072 wrote to memory of 3720 2072 4820.tmp 104 PID 3720 wrote to memory of 2788 3720 48DB.tmp 105 PID 2788 wrote to memory of 1952 2788 4978.tmp 106 PID 1952 wrote to memory of 1784 1952 4A33.tmp 107 PID 1784 wrote to memory of 5320 1784 4AA0.tmp 108 PID 5320 wrote to memory of 2064 5320 4B0E.tmp 110 PID 2064 wrote to memory of 832 2064 4B7B.tmp 111 PID 832 wrote to memory of 1036 832 4C08.tmp 113 PID 1036 wrote to memory of 3096 1036 4C94.tmp 114 PID 3096 wrote to memory of 2796 3096 4D40.tmp 115 PID 2796 wrote to memory of 2156 2796 4DCD.tmp 116 PID 2156 wrote to memory of 1892 2156 4E5A.tmp 117 PID 1892 wrote to memory of 3424 1892 4F05.tmp 119 PID 3424 wrote to memory of 5652 3424 4FC1.tmp 120 PID 5652 wrote to memory of 5236 5652 505D.tmp 121 PID 5236 wrote to memory of 5516 5236 50F9.tmp 122 PID 5516 wrote to memory of 5284 5516 5186.tmp 123 PID 5284 wrote to memory of 2708 5284 51D4.tmp 124 PID 2708 wrote to memory of 4516 2708 5232.tmp 125 PID 4516 wrote to memory of 5452 4516 5280.tmp 126 PID 5452 wrote to memory of 3572 5452 52CE.tmp 127 PID 3572 wrote to memory of 2732 3572 532C.tmp 128 PID 2732 wrote to memory of 3512 2732 537A.tmp 129 PID 3512 wrote to memory of 4880 3512 53C8.tmp 130 PID 4880 wrote to memory of 5480 4880 5416.tmp 131 PID 5480 wrote to memory of 5276 5480 5474.tmp 132 PID 5276 wrote to memory of 1992 5276 54D2.tmp 133 PID 1992 wrote to memory of 5600 1992 5530.tmp 134 PID 5600 wrote to memory of 1364 5600 557E.tmp 135 PID 1364 wrote to memory of 892 1364 55DB.tmp 136 PID 892 wrote to memory of 2964 892 562A.tmp 137 PID 2964 wrote to memory of 312 2964 5678.tmp 138 PID 312 wrote to memory of 1248 312 56C6.tmp 139 PID 1248 wrote to memory of 5440 1248 5724.tmp 141 PID 5440 wrote to memory of 4000 5440 5772.tmp 142 PID 4000 wrote to memory of 3312 4000 57C0.tmp 143 PID 3312 wrote to memory of 1948 3312 580E.tmp 144 PID 1948 wrote to memory of 6008 1948 585C.tmp 145 PID 6008 wrote to memory of 5980 6008 58AA.tmp 146 PID 5980 wrote to memory of 5896 5980 58F8.tmp 147 PID 5896 wrote to memory of 4920 5896 5946.tmp 148 PID 4920 wrote to memory of 2380 4920 5995.tmp 149 PID 2380 wrote to memory of 5944 2380 5A02.tmp 150 PID 5944 wrote to memory of 3288 5944 5A50.tmp 151 PID 3288 wrote to memory of 4176 3288 5A9E.tmp 152 PID 4176 wrote to memory of 5484 4176 5AEC.tmp 153 PID 5484 wrote to memory of 4044 5484 5B3A.tmp 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_2f7ad8b280d4cc6d867bd4180aee6e76_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_2f7ad8b280d4cc6d867bd4180aee6e76_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\3F27.tmp"C:\Users\Admin\AppData\Local\Temp\3F27.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6080 -
C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6044 -
C:\Users\Admin\AppData\Local\Temp\405F.tmp"C:\Users\Admin\AppData\Local\Temp\405F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\40DC.tmp"C:\Users\Admin\AppData\Local\Temp\40DC.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\4179.tmp"C:\Users\Admin\AppData\Local\Temp\4179.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5884 -
C:\Users\Admin\AppData\Local\Temp\4215.tmp"C:\Users\Admin\AppData\Local\Temp\4215.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\42E0.tmp"C:\Users\Admin\AppData\Local\Temp\42E0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\435D.tmp"C:\Users\Admin\AppData\Local\Temp\435D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\4419.tmp"C:\Users\Admin\AppData\Local\Temp\4419.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\44B5.tmp"C:\Users\Admin\AppData\Local\Temp\44B5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\4532.tmp"C:\Users\Admin\AppData\Local\Temp\4532.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\45CE.tmp"C:\Users\Admin\AppData\Local\Temp\45CE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\465B.tmp"C:\Users\Admin\AppData\Local\Temp\465B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\46D8.tmp"C:\Users\Admin\AppData\Local\Temp\46D8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\4755.tmp"C:\Users\Admin\AppData\Local\Temp\4755.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5736 -
C:\Users\Admin\AppData\Local\Temp\4820.tmp"C:\Users\Admin\AppData\Local\Temp\4820.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\48DB.tmp"C:\Users\Admin\AppData\Local\Temp\48DB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\4978.tmp"C:\Users\Admin\AppData\Local\Temp\4978.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\4A33.tmp"C:\Users\Admin\AppData\Local\Temp\4A33.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"C:\Users\Admin\AppData\Local\Temp\4AA0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"C:\Users\Admin\AppData\Local\Temp\4B0E.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"C:\Users\Admin\AppData\Local\Temp\4B7B.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\4C08.tmp"C:\Users\Admin\AppData\Local\Temp\4C08.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\4C94.tmp"C:\Users\Admin\AppData\Local\Temp\4C94.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\4D40.tmp"C:\Users\Admin\AppData\Local\Temp\4D40.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\4DCD.tmp"C:\Users\Admin\AppData\Local\Temp\4DCD.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\4F05.tmp"C:\Users\Admin\AppData\Local\Temp\4F05.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"C:\Users\Admin\AppData\Local\Temp\4FC1.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\505D.tmp"C:\Users\Admin\AppData\Local\Temp\505D.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\50F9.tmp"C:\Users\Admin\AppData\Local\Temp\50F9.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Users\Admin\AppData\Local\Temp\5186.tmp"C:\Users\Admin\AppData\Local\Temp\5186.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\51D4.tmp"C:\Users\Admin\AppData\Local\Temp\51D4.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\5232.tmp"C:\Users\Admin\AppData\Local\Temp\5232.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\5280.tmp"C:\Users\Admin\AppData\Local\Temp\5280.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\52CE.tmp"C:\Users\Admin\AppData\Local\Temp\52CE.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5452 -
C:\Users\Admin\AppData\Local\Temp\532C.tmp"C:\Users\Admin\AppData\Local\Temp\532C.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\537A.tmp"C:\Users\Admin\AppData\Local\Temp\537A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\53C8.tmp"C:\Users\Admin\AppData\Local\Temp\53C8.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\5416.tmp"C:\Users\Admin\AppData\Local\Temp\5416.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\5474.tmp"C:\Users\Admin\AppData\Local\Temp\5474.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5480 -
C:\Users\Admin\AppData\Local\Temp\54D2.tmp"C:\Users\Admin\AppData\Local\Temp\54D2.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5276 -
C:\Users\Admin\AppData\Local\Temp\5530.tmp"C:\Users\Admin\AppData\Local\Temp\5530.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\557E.tmp"C:\Users\Admin\AppData\Local\Temp\557E.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Users\Admin\AppData\Local\Temp\55DB.tmp"C:\Users\Admin\AppData\Local\Temp\55DB.tmp"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\562A.tmp"C:\Users\Admin\AppData\Local\Temp\562A.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\5678.tmp"C:\Users\Admin\AppData\Local\Temp\5678.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\56C6.tmp"C:\Users\Admin\AppData\Local\Temp\56C6.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Users\Admin\AppData\Local\Temp\5724.tmp"C:\Users\Admin\AppData\Local\Temp\5724.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\5772.tmp"C:\Users\Admin\AppData\Local\Temp\5772.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Users\Admin\AppData\Local\Temp\57C0.tmp"C:\Users\Admin\AppData\Local\Temp\57C0.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\580E.tmp"C:\Users\Admin\AppData\Local\Temp\580E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\585C.tmp"C:\Users\Admin\AppData\Local\Temp\585C.tmp"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\58AA.tmp"C:\Users\Admin\AppData\Local\Temp\58AA.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\58F8.tmp"C:\Users\Admin\AppData\Local\Temp\58F8.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\5946.tmp"C:\Users\Admin\AppData\Local\Temp\5946.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5896 -
C:\Users\Admin\AppData\Local\Temp\5995.tmp"C:\Users\Admin\AppData\Local\Temp\5995.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\5A02.tmp"C:\Users\Admin\AppData\Local\Temp\5A02.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"C:\Users\Admin\AppData\Local\Temp\5B3A.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\5B89.tmp"C:\Users\Admin\AppData\Local\Temp\5B89.tmp"65⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"C:\Users\Admin\AppData\Local\Temp\5BD7.tmp"66⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\5C25.tmp"C:\Users\Admin\AppData\Local\Temp\5C25.tmp"67⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\5C83.tmp"C:\Users\Admin\AppData\Local\Temp\5C83.tmp"68⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\5CE0.tmp"C:\Users\Admin\AppData\Local\Temp\5CE0.tmp"69⤵PID:5628
-
C:\Users\Admin\AppData\Local\Temp\5D3E.tmp"C:\Users\Admin\AppData\Local\Temp\5D3E.tmp"70⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\5D9C.tmp"C:\Users\Admin\AppData\Local\Temp\5D9C.tmp"71⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"C:\Users\Admin\AppData\Local\Temp\5DFA.tmp"72⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\5E57.tmp"C:\Users\Admin\AppData\Local\Temp\5E57.tmp"73⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"C:\Users\Admin\AppData\Local\Temp\5EC5.tmp"74⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\5F13.tmp"C:\Users\Admin\AppData\Local\Temp\5F13.tmp"75⤵PID:5892
-
C:\Users\Admin\AppData\Local\Temp\5F80.tmp"C:\Users\Admin\AppData\Local\Temp\5F80.tmp"76⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"C:\Users\Admin\AppData\Local\Temp\5FCE.tmp"77⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\602C.tmp"C:\Users\Admin\AppData\Local\Temp\602C.tmp"78⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\607A.tmp"C:\Users\Admin\AppData\Local\Temp\607A.tmp"79⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\60C8.tmp"C:\Users\Admin\AppData\Local\Temp\60C8.tmp"80⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\6126.tmp"C:\Users\Admin\AppData\Local\Temp\6126.tmp"81⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\6174.tmp"C:\Users\Admin\AppData\Local\Temp\6174.tmp"82⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\61E2.tmp"C:\Users\Admin\AppData\Local\Temp\61E2.tmp"83⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\623F.tmp"C:\Users\Admin\AppData\Local\Temp\623F.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:5128 -
C:\Users\Admin\AppData\Local\Temp\629D.tmp"C:\Users\Admin\AppData\Local\Temp\629D.tmp"85⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\62FB.tmp"C:\Users\Admin\AppData\Local\Temp\62FB.tmp"86⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\6349.tmp"C:\Users\Admin\AppData\Local\Temp\6349.tmp"87⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\6397.tmp"C:\Users\Admin\AppData\Local\Temp\6397.tmp"88⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\63E5.tmp"C:\Users\Admin\AppData\Local\Temp\63E5.tmp"89⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\6433.tmp"C:\Users\Admin\AppData\Local\Temp\6433.tmp"90⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\6481.tmp"C:\Users\Admin\AppData\Local\Temp\6481.tmp"91⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\64D0.tmp"C:\Users\Admin\AppData\Local\Temp\64D0.tmp"92⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\653D.tmp"C:\Users\Admin\AppData\Local\Temp\653D.tmp"93⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\659B.tmp"C:\Users\Admin\AppData\Local\Temp\659B.tmp"94⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\6608.tmp"C:\Users\Admin\AppData\Local\Temp\6608.tmp"95⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\6666.tmp"C:\Users\Admin\AppData\Local\Temp\6666.tmp"96⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\66C4.tmp"C:\Users\Admin\AppData\Local\Temp\66C4.tmp"97⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\6712.tmp"C:\Users\Admin\AppData\Local\Temp\6712.tmp"98⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\6760.tmp"C:\Users\Admin\AppData\Local\Temp\6760.tmp"99⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\67AE.tmp"C:\Users\Admin\AppData\Local\Temp\67AE.tmp"100⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\680C.tmp"C:\Users\Admin\AppData\Local\Temp\680C.tmp"101⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\685A.tmp"C:\Users\Admin\AppData\Local\Temp\685A.tmp"102⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\68A8.tmp"C:\Users\Admin\AppData\Local\Temp\68A8.tmp"103⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\68F6.tmp"C:\Users\Admin\AppData\Local\Temp\68F6.tmp"104⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\6954.tmp"C:\Users\Admin\AppData\Local\Temp\6954.tmp"105⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\69A2.tmp"C:\Users\Admin\AppData\Local\Temp\69A2.tmp"106⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\69F0.tmp"C:\Users\Admin\AppData\Local\Temp\69F0.tmp"107⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\6A4E.tmp"C:\Users\Admin\AppData\Local\Temp\6A4E.tmp"108⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"C:\Users\Admin\AppData\Local\Temp\6AAC.tmp"109⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\6B09.tmp"C:\Users\Admin\AppData\Local\Temp\6B09.tmp"110⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\6B57.tmp"C:\Users\Admin\AppData\Local\Temp\6B57.tmp"111⤵PID:5812
-
C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"C:\Users\Admin\AppData\Local\Temp\6BA6.tmp"112⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\6C03.tmp"C:\Users\Admin\AppData\Local\Temp\6C03.tmp"113⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\6C71.tmp"C:\Users\Admin\AppData\Local\Temp\6C71.tmp"114⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"C:\Users\Admin\AppData\Local\Temp\6CCE.tmp"115⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"C:\Users\Admin\AppData\Local\Temp\6D1D.tmp"116⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\6D8A.tmp"C:\Users\Admin\AppData\Local\Temp\6D8A.tmp"117⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"C:\Users\Admin\AppData\Local\Temp\6DF7.tmp"118⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\6E65.tmp"C:\Users\Admin\AppData\Local\Temp\6E65.tmp"119⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\6EB3.tmp"C:\Users\Admin\AppData\Local\Temp\6EB3.tmp"120⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\6F20.tmp"C:\Users\Admin\AppData\Local\Temp\6F20.tmp"121⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\6F6E.tmp"C:\Users\Admin\AppData\Local\Temp\6F6E.tmp"122⤵PID:2036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-