Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 18:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_69b29be595eeee793970a6441c3fa11a_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_69b29be595eeee793970a6441c3fa11a_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-02_69b29be595eeee793970a6441c3fa11a_elex_mafia_stealc_tofsee.exe
- Size 529KB
- Sample260802-wt38csdh65
- SHA256 117672eb05a1c6ae6ab1ae118391f4b833c75890eb53097822cd67800f2a28d0
- MD5 69b29be595eeee793970a6441c3fa11a
- SHA1 85c4bf8e0ce9e50c6c2e0f099868c89ecf2b0f0a
- SHA512 e465e4e65e90dc0399d8a70c6f3519006480e8ebd992bce6b46bb8613903ab6df8d249ff54a672d09975da31e28182f56012fd8a87cefc51d37a9c406a352659
- SSDEEP 12288:NU5rCOTeijxXoDrzdVSg/FQA+bTQxiAQ+6TZwlH4Hp:NUQOJjxmrbx/rASQjTSlH4Hp
- TLSH T14BB4E126B685C232E58301711BD6EBE26A3F7C755726A0C33B84663E2FB52E1D375306
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3300 9565.tmp 3804 964F.tmp 2176 96DC.tmp 4152 9798.tmp 2172 9824.tmp 764 98C0.tmp 3536 993D.tmp 1132 99CA.tmp 3904 9A66.tmp 3308 9B03.tmp 4768 9B80.tmp 1792 9C3B.tmp 4580 9CA8.tmp 4380 9D64.tmp 3908 9E1F.tmp 5004 9EEB.tmp 3296 9F77.tmp 2128 A004.tmp 2864 A0B0.tmp 4344 A13C.tmp 4028 A1B9.tmp 3332 A246.tmp 1688 A301.tmp 4104 A3BD.tmp 372 A459.tmp 2424 A4E6.tmp 3868 A572.tmp 4324 A5FF.tmp 1240 A6BB.tmp 3276 A786.tmp 1904 A841.tmp 5072 A8FD.tmp 2988 A9C8.tmp 768 AA35.tmp 4656 AA93.tmp 3112 AAE1.tmp 652 AB4E.tmp 2384 AB9D.tmp 5052 ABFA.tmp 4364 AC58.tmp 4884 ACA6.tmp 4852 AD52.tmp 648 ADA0.tmp 364 ADEE.tmp 2504 AE3C.tmp 816 AE8B.tmp 1112 AED9.tmp 2224 AF46.tmp 4892 AFA4.tmp 2888 AFF2.tmp 4572 B040.tmp 1160 B09E.tmp 4476 B0FC.tmp 5088 B169.tmp 4392 B1B7.tmp 4560 B224.tmp 4552 B273.tmp 1592 B2D0.tmp 1696 B32E.tmp 2272 B39B.tmp 2072 B3EA.tmp 3788 B438.tmp 2060 B486.tmp 4992 B4E4.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 239B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2503.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 790E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 811D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3455.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C994.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 796C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A54E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D920.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 219.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 502.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E75D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6279.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E412.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 388B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E584.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FCBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 805.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3176.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 355E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4656.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5016 wrote to memory of 3300 5016 2026-08-02_69b29be595eeee793970a6441c3fa11a_elex_mafia_stealc_tofsee.exe 85 PID 3300 wrote to memory of 3804 3300 9565.tmp 86 PID 3804 wrote to memory of 2176 3804 964F.tmp 87 PID 2176 wrote to memory of 4152 2176 96DC.tmp 88 PID 4152 wrote to memory of 2172 4152 9798.tmp 89 PID 2172 wrote to memory of 764 2172 9824.tmp 90 PID 764 wrote to memory of 3536 764 98C0.tmp 91 PID 3536 wrote to memory of 1132 3536 993D.tmp 92 PID 1132 wrote to memory of 3904 1132 99CA.tmp 93 PID 3904 wrote to memory of 3308 3904 9A66.tmp 94 PID 3308 wrote to memory of 4768 3308 9B03.tmp 95 PID 4768 wrote to memory of 1792 4768 9B80.tmp 96 PID 1792 wrote to memory of 4580 1792 9C3B.tmp 97 PID 4580 wrote to memory of 4380 4580 9CA8.tmp 98 PID 4380 wrote to memory of 3908 4380 9D64.tmp 99 PID 3908 wrote to memory of 5004 3908 9E1F.tmp 100 PID 5004 wrote to memory of 3296 5004 9EEB.tmp 101 PID 3296 wrote to memory of 2128 3296 9F77.tmp 104 PID 2128 wrote to memory of 2864 2128 A004.tmp 105 PID 2864 wrote to memory of 4344 2864 A0B0.tmp 106 PID 4344 wrote to memory of 4028 4344 A13C.tmp 107 PID 4028 wrote to memory of 3332 4028 A1B9.tmp 109 PID 3332 wrote to memory of 1688 3332 A246.tmp 110 PID 1688 wrote to memory of 4104 1688 A301.tmp 111 PID 4104 wrote to memory of 372 4104 A3BD.tmp 114 PID 372 wrote to memory of 2424 372 A459.tmp 117 PID 2424 wrote to memory of 3868 2424 A4E6.tmp 119 PID 3868 wrote to memory of 4324 3868 A572.tmp 120 PID 4324 wrote to memory of 1240 4324 A5FF.tmp 121 PID 1240 wrote to memory of 3276 1240 A6BB.tmp 122 PID 3276 wrote to memory of 1904 3276 A786.tmp 123 PID 1904 wrote to memory of 5072 1904 A841.tmp 124 PID 5072 wrote to memory of 2988 5072 A8FD.tmp 125 PID 2988 wrote to memory of 768 2988 A9C8.tmp 126 PID 768 wrote to memory of 4656 768 AA35.tmp 127 PID 4656 wrote to memory of 3112 4656 AA93.tmp 128 PID 3112 wrote to memory of 652 3112 AAE1.tmp 129 PID 652 wrote to memory of 2384 652 AB4E.tmp 130 PID 2384 wrote to memory of 5052 2384 AB9D.tmp 131 PID 5052 wrote to memory of 4364 5052 ABFA.tmp 132 PID 4364 wrote to memory of 4884 4364 AC58.tmp 133 PID 4332 wrote to memory of 4852 4332 AD04.tmp 135 PID 4852 wrote to memory of 648 4852 AD52.tmp 136 PID 648 wrote to memory of 364 648 ADA0.tmp 137 PID 364 wrote to memory of 2504 364 ADEE.tmp 138 PID 2504 wrote to memory of 816 2504 AE3C.tmp 139 PID 816 wrote to memory of 1112 816 AE8B.tmp 140 PID 1112 wrote to memory of 2224 1112 AED9.tmp 141 PID 2224 wrote to memory of 4892 2224 AF46.tmp 142 PID 4892 wrote to memory of 2888 4892 AFA4.tmp 143 PID 2888 wrote to memory of 4572 2888 AFF2.tmp 145 PID 4572 wrote to memory of 1160 4572 B040.tmp 146 PID 1160 wrote to memory of 4476 1160 B09E.tmp 147 PID 4476 wrote to memory of 5088 4476 B0FC.tmp 148 PID 5088 wrote to memory of 4392 5088 B169.tmp 149 PID 4392 wrote to memory of 4560 4392 B1B7.tmp 150 PID 4560 wrote to memory of 4552 4560 B224.tmp 151 PID 4552 wrote to memory of 1592 4552 B273.tmp 152 PID 1592 wrote to memory of 1696 1592 B2D0.tmp 153 PID 1696 wrote to memory of 2272 1696 B32E.tmp 154 PID 2272 wrote to memory of 2072 2272 B39B.tmp 155 PID 2072 wrote to memory of 3788 2072 B3EA.tmp 156 PID 3788 wrote to memory of 2060 3788 B438.tmp 157 PID 2060 wrote to memory of 4992 2060 B486.tmp 158
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_69b29be595eeee793970a6441c3fa11a_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_69b29be595eeee793970a6441c3fa11a_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\9565.tmp"C:\Users\Admin\AppData\Local\Temp\9565.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\964F.tmp"C:\Users\Admin\AppData\Local\Temp\964F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\96DC.tmp"C:\Users\Admin\AppData\Local\Temp\96DC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\9798.tmp"C:\Users\Admin\AppData\Local\Temp\9798.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\9824.tmp"C:\Users\Admin\AppData\Local\Temp\9824.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\98C0.tmp"C:\Users\Admin\AppData\Local\Temp\98C0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\993D.tmp"C:\Users\Admin\AppData\Local\Temp\993D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\99CA.tmp"C:\Users\Admin\AppData\Local\Temp\99CA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\9A66.tmp"C:\Users\Admin\AppData\Local\Temp\9A66.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\9B03.tmp"C:\Users\Admin\AppData\Local\Temp\9B03.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\9B80.tmp"C:\Users\Admin\AppData\Local\Temp\9B80.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\9C3B.tmp"C:\Users\Admin\AppData\Local\Temp\9C3B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\9CA8.tmp"C:\Users\Admin\AppData\Local\Temp\9CA8.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\9D64.tmp"C:\Users\Admin\AppData\Local\Temp\9D64.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\9E1F.tmp"C:\Users\Admin\AppData\Local\Temp\9E1F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\9EEB.tmp"C:\Users\Admin\AppData\Local\Temp\9EEB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\9F77.tmp"C:\Users\Admin\AppData\Local\Temp\9F77.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\A004.tmp"C:\Users\Admin\AppData\Local\Temp\A004.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\A0B0.tmp"C:\Users\Admin\AppData\Local\Temp\A0B0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\A13C.tmp"C:\Users\Admin\AppData\Local\Temp\A13C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\A1B9.tmp"C:\Users\Admin\AppData\Local\Temp\A1B9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\A246.tmp"C:\Users\Admin\AppData\Local\Temp\A246.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Users\Admin\AppData\Local\Temp\A301.tmp"C:\Users\Admin\AppData\Local\Temp\A301.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\A3BD.tmp"C:\Users\Admin\AppData\Local\Temp\A3BD.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\A459.tmp"C:\Users\Admin\AppData\Local\Temp\A459.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Users\Admin\AppData\Local\Temp\A4E6.tmp"C:\Users\Admin\AppData\Local\Temp\A4E6.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\A572.tmp"C:\Users\Admin\AppData\Local\Temp\A572.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\A786.tmp"C:\Users\Admin\AppData\Local\Temp\A786.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\A841.tmp"C:\Users\Admin\AppData\Local\Temp\A841.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\A8FD.tmp"C:\Users\Admin\AppData\Local\Temp\A8FD.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\AA35.tmp"C:\Users\Admin\AppData\Local\Temp\AA35.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\AA93.tmp"C:\Users\Admin\AppData\Local\Temp\AA93.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\AAE1.tmp"C:\Users\Admin\AppData\Local\Temp\AAE1.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\AB4E.tmp"C:\Users\Admin\AppData\Local\Temp\AB4E.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\AB9D.tmp"C:\Users\Admin\AppData\Local\Temp\AB9D.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\ABFA.tmp"C:\Users\Admin\AppData\Local\Temp\ABFA.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\AC58.tmp"C:\Users\Admin\AppData\Local\Temp\AC58.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\ACA6.tmp"C:\Users\Admin\AppData\Local\Temp\ACA6.tmp"42⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\AD04.tmp"C:\Users\Admin\AppData\Local\Temp\AD04.tmp"43⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\AD52.tmp"C:\Users\Admin\AppData\Local\Temp\AD52.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\ADA0.tmp"C:\Users\Admin\AppData\Local\Temp\ADA0.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\ADEE.tmp"C:\Users\Admin\AppData\Local\Temp\ADEE.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\AE3C.tmp"C:\Users\Admin\AppData\Local\Temp\AE3C.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\AE8B.tmp"C:\Users\Admin\AppData\Local\Temp\AE8B.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\AED9.tmp"C:\Users\Admin\AppData\Local\Temp\AED9.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\AF46.tmp"C:\Users\Admin\AppData\Local\Temp\AF46.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\AFA4.tmp"C:\Users\Admin\AppData\Local\Temp\AFA4.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\AFF2.tmp"C:\Users\Admin\AppData\Local\Temp\AFF2.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\B040.tmp"C:\Users\Admin\AppData\Local\Temp\B040.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\B09E.tmp"C:\Users\Admin\AppData\Local\Temp\B09E.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\B0FC.tmp"C:\Users\Admin\AppData\Local\Temp\B0FC.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\B169.tmp"C:\Users\Admin\AppData\Local\Temp\B169.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\B1B7.tmp"C:\Users\Admin\AppData\Local\Temp\B1B7.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\B224.tmp"C:\Users\Admin\AppData\Local\Temp\B224.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\B273.tmp"C:\Users\Admin\AppData\Local\Temp\B273.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\B2D0.tmp"C:\Users\Admin\AppData\Local\Temp\B2D0.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\B32E.tmp"C:\Users\Admin\AppData\Local\Temp\B32E.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\B39B.tmp"C:\Users\Admin\AppData\Local\Temp\B39B.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\B3EA.tmp"C:\Users\Admin\AppData\Local\Temp\B3EA.tmp"63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\B438.tmp"C:\Users\Admin\AppData\Local\Temp\B438.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\B486.tmp"C:\Users\Admin\AppData\Local\Temp\B486.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\B4E4.tmp"C:\Users\Admin\AppData\Local\Temp\B4E4.tmp"66⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\B532.tmp"C:\Users\Admin\AppData\Local\Temp\B532.tmp"67⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\B58F.tmp"C:\Users\Admin\AppData\Local\Temp\B58F.tmp"68⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\B5DE.tmp"C:\Users\Admin\AppData\Local\Temp\B5DE.tmp"69⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\B63B.tmp"C:\Users\Admin\AppData\Local\Temp\B63B.tmp"70⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\B699.tmp"C:\Users\Admin\AppData\Local\Temp\B699.tmp"71⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\B6F7.tmp"C:\Users\Admin\AppData\Local\Temp\B6F7.tmp"72⤵PID:204
-
C:\Users\Admin\AppData\Local\Temp\B774.tmp"C:\Users\Admin\AppData\Local\Temp\B774.tmp"73⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\B7C2.tmp"C:\Users\Admin\AppData\Local\Temp\B7C2.tmp"74⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\B810.tmp"C:\Users\Admin\AppData\Local\Temp\B810.tmp"75⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\B85E.tmp"C:\Users\Admin\AppData\Local\Temp\B85E.tmp"76⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\B8AC.tmp"C:\Users\Admin\AppData\Local\Temp\B8AC.tmp"77⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\B90A.tmp"C:\Users\Admin\AppData\Local\Temp\B90A.tmp"78⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\B968.tmp"C:\Users\Admin\AppData\Local\Temp\B968.tmp"79⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\B9B6.tmp"C:\Users\Admin\AppData\Local\Temp\B9B6.tmp"80⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\BA23.tmp"C:\Users\Admin\AppData\Local\Temp\BA23.tmp"81⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\BA91.tmp"C:\Users\Admin\AppData\Local\Temp\BA91.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\BAFE.tmp"C:\Users\Admin\AppData\Local\Temp\BAFE.tmp"83⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\BB6B.tmp"C:\Users\Admin\AppData\Local\Temp\BB6B.tmp"84⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\BBBA.tmp"C:\Users\Admin\AppData\Local\Temp\BBBA.tmp"85⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\BC08.tmp"C:\Users\Admin\AppData\Local\Temp\BC08.tmp"86⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\BC56.tmp"C:\Users\Admin\AppData\Local\Temp\BC56.tmp"87⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\BCA4.tmp"C:\Users\Admin\AppData\Local\Temp\BCA4.tmp"88⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\BCF2.tmp"C:\Users\Admin\AppData\Local\Temp\BCF2.tmp"89⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\BD40.tmp"C:\Users\Admin\AppData\Local\Temp\BD40.tmp"90⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"91⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\BDEC.tmp"C:\Users\Admin\AppData\Local\Temp\BDEC.tmp"92⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\BE3A.tmp"C:\Users\Admin\AppData\Local\Temp\BE3A.tmp"93⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\BE88.tmp"C:\Users\Admin\AppData\Local\Temp\BE88.tmp"94⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\BEE6.tmp"C:\Users\Admin\AppData\Local\Temp\BEE6.tmp"95⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\BF34.tmp"C:\Users\Admin\AppData\Local\Temp\BF34.tmp"96⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\BF92.tmp"C:\Users\Admin\AppData\Local\Temp\BF92.tmp"97⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\BFE0.tmp"C:\Users\Admin\AppData\Local\Temp\BFE0.tmp"98⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\C02E.tmp"C:\Users\Admin\AppData\Local\Temp\C02E.tmp"99⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\C09C.tmp"C:\Users\Admin\AppData\Local\Temp\C09C.tmp"100⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\C109.tmp"C:\Users\Admin\AppData\Local\Temp\C109.tmp"101⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\C176.tmp"C:\Users\Admin\AppData\Local\Temp\C176.tmp"102⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\C1E4.tmp"C:\Users\Admin\AppData\Local\Temp\C1E4.tmp"103⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\C241.tmp"C:\Users\Admin\AppData\Local\Temp\C241.tmp"104⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\C290.tmp"C:\Users\Admin\AppData\Local\Temp\C290.tmp"105⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\C2ED.tmp"C:\Users\Admin\AppData\Local\Temp\C2ED.tmp"106⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\C35B.tmp"C:\Users\Admin\AppData\Local\Temp\C35B.tmp"107⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\C3C8.tmp"C:\Users\Admin\AppData\Local\Temp\C3C8.tmp"108⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\C416.tmp"C:\Users\Admin\AppData\Local\Temp\C416.tmp"109⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\C464.tmp"C:\Users\Admin\AppData\Local\Temp\C464.tmp"110⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\C4E1.tmp"C:\Users\Admin\AppData\Local\Temp\C4E1.tmp"111⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\C54F.tmp"C:\Users\Admin\AppData\Local\Temp\C54F.tmp"112⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\C59D.tmp"C:\Users\Admin\AppData\Local\Temp\C59D.tmp"113⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\C5FB.tmp"C:\Users\Admin\AppData\Local\Temp\C5FB.tmp"114⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\C658.tmp"C:\Users\Admin\AppData\Local\Temp\C658.tmp"115⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\C6B6.tmp"C:\Users\Admin\AppData\Local\Temp\C6B6.tmp"116⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\C704.tmp"C:\Users\Admin\AppData\Local\Temp\C704.tmp"117⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\C762.tmp"C:\Users\Admin\AppData\Local\Temp\C762.tmp"118⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"C:\Users\Admin\AppData\Local\Temp\C7B0.tmp"119⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\C80E.tmp"C:\Users\Admin\AppData\Local\Temp\C80E.tmp"120⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\C86C.tmp"C:\Users\Admin\AppData\Local\Temp\C86C.tmp"121⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\C8C9.tmp"C:\Users\Admin\AppData\Local\Temp\C8C9.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-