Analysis
- max time kernel
126s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 10:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-18_b5eed63a6bffe5bdabb62fe9b7b877f7_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_b5eed63a6bffe5bdabb62fe9b7b877f7_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-18_b5eed63a6bffe5bdabb62fe9b7b877f7_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260718-mlnchagv3n
- SHA256 f5553b5228020aa57ba01131c0ed104c23fa1b158fb765ce690aaf417523b6ef
- MD5 b5eed63a6bffe5bdabb62fe9b7b877f7
- SHA1 314b6b83ac617b080e5881943dd6f792c7bf7a87
- SHA512 460f112b765d46b46937816b25abe6d8f5f8b4a84784fded8d8941dd703ddc61b58a07a30dcdaa9634b9f6bd485c29bbd72144c1c0f9587ed08de2b1d89a9bf4
- SSDEEP 12288:wU5rCOTeiDcvClXXDqruXWdtgEMKCjLOq9OCNZ+3/v+I9hUG2VA:wUQOJDpu6amXKCfOIOCNGEA
- TLSH T1B1E4D02173D88536E9FB037859B5E661497EBD22A722D6DF2F80117E0A71BC0CA31763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2504 FD08.tmp 4660 FDB4.tmp 3044 FF1C.tmp 5540 44.tmp 4408 16D.tmp 4776 1EA.tmp 4584 371.tmp 1600 45B.tmp 4772 4C9.tmp 4456 536.tmp 1736 72A.tmp 5492 863.tmp 568 98B.tmp 5624 AD4.tmp 4752 BCE.tmp 5052 CC8.tmp 236 D73.tmp 2648 E8D.tmp 5088 FE4.tmp 5368 10EE.tmp 2820 11B9.tmp 996 1311.tmp 4652 141B.tmp 4704 1515.tmp 1612 163D.tmp 5004 1766.tmp 6096 1860.tmp 2404 196A.tmp 1512 1AA2.tmp 2888 1B7D.tmp 2780 1CD5.tmp 2640 1DEE.tmp 3824 1EE8.tmp 1468 1FB3.tmp 1656 2050.tmp 4864 20FB.tmp 5488 21C7.tmp 4112 2292.tmp 2320 237C.tmp 2420 2428.tmp 4144 2503.tmp 5572 25DD.tmp 756 2689.tmp 1260 2764.tmp 4444 282F.tmp 5536 28DB.tmp 3476 2977.tmp 3800 2A42.tmp 3752 2AEE.tmp 3004 2B6B.tmp 5464 2BE8.tmp 3292 2C65.tmp 4616 2CE2.tmp 4644 2D5F.tmp 4724 2DDC.tmp 1168 2E4A.tmp 6024 2EB7.tmp 4340 2F44.tmp 5420 2FC1.tmp 3792 303E.tmp 3844 30AB.tmp 4148 3118.tmp 6100 3195.tmp 1368 3212.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9898.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A048.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B96E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4898.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A908.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 163D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 901C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9135.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D65C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E485.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A54A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D17A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1311.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 426E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C79C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1619.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8543.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 708E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2F00.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E243.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9457.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7A5.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2504 2964 2026-07-18_b5eed63a6bffe5bdabb62fe9b7b877f7_elex_mafia_stealc_tofsee.exe 89 PID 2504 wrote to memory of 4660 2504 FD08.tmp 90 PID 4660 wrote to memory of 3044 4660 FDB4.tmp 91 PID 3044 wrote to memory of 5540 3044 FF1C.tmp 92 PID 5540 wrote to memory of 4408 5540 44.tmp 93 PID 4408 wrote to memory of 4776 4408 16D.tmp 94 PID 4776 wrote to memory of 4584 4776 1EA.tmp 95 PID 4584 wrote to memory of 1600 4584 371.tmp 96 PID 1600 wrote to memory of 4772 1600 45B.tmp 97 PID 4772 wrote to memory of 4456 4772 4C9.tmp 98 PID 4456 wrote to memory of 1736 4456 536.tmp 99 PID 1736 wrote to memory of 5492 1736 72A.tmp 100 PID 5492 wrote to memory of 568 5492 863.tmp 101 PID 568 wrote to memory of 5624 568 98B.tmp 102 PID 5624 wrote to memory of 4752 5624 AD4.tmp 103 PID 4752 wrote to memory of 5052 4752 BCE.tmp 104 PID 5052 wrote to memory of 236 5052 CC8.tmp 105 PID 236 wrote to memory of 2648 236 D73.tmp 106 PID 2648 wrote to memory of 5088 2648 E8D.tmp 107 PID 5088 wrote to memory of 5368 5088 FE4.tmp 108 PID 5368 wrote to memory of 2820 5368 10EE.tmp 109 PID 2820 wrote to memory of 996 2820 11B9.tmp 110 PID 996 wrote to memory of 4652 996 1311.tmp 111 PID 4652 wrote to memory of 4704 4652 141B.tmp 112 PID 4704 wrote to memory of 1612 4704 1515.tmp 113 PID 1612 wrote to memory of 5004 1612 163D.tmp 114 PID 5004 wrote to memory of 6096 5004 1766.tmp 115 PID 6096 wrote to memory of 2404 6096 1860.tmp 116 PID 2404 wrote to memory of 1512 2404 196A.tmp 117 PID 1512 wrote to memory of 2888 1512 1AA2.tmp 118 PID 2888 wrote to memory of 2780 2888 1B7D.tmp 119 PID 2780 wrote to memory of 2640 2780 1CD5.tmp 120 PID 2640 wrote to memory of 3824 2640 1DEE.tmp 121 PID 3824 wrote to memory of 1468 3824 1EE8.tmp 122 PID 1468 wrote to memory of 1656 1468 1FB3.tmp 123 PID 1656 wrote to memory of 4864 1656 2050.tmp 124 PID 4864 wrote to memory of 5488 4864 20FB.tmp 125 PID 5488 wrote to memory of 4112 5488 21C7.tmp 126 PID 4112 wrote to memory of 2320 4112 2292.tmp 127 PID 2320 wrote to memory of 2420 2320 237C.tmp 128 PID 2420 wrote to memory of 4144 2420 2428.tmp 129 PID 4144 wrote to memory of 5572 4144 2503.tmp 130 PID 5572 wrote to memory of 756 5572 25DD.tmp 131 PID 756 wrote to memory of 1260 756 2689.tmp 132 PID 1260 wrote to memory of 4444 1260 2764.tmp 133 PID 4444 wrote to memory of 5536 4444 282F.tmp 134 PID 5536 wrote to memory of 3476 5536 28DB.tmp 135 PID 3476 wrote to memory of 3800 3476 2977.tmp 136 PID 3800 wrote to memory of 3752 3800 2A42.tmp 137 PID 3752 wrote to memory of 3004 3752 2AEE.tmp 138 PID 3004 wrote to memory of 5464 3004 2B6B.tmp 139 PID 5464 wrote to memory of 3292 5464 2BE8.tmp 140 PID 3292 wrote to memory of 4616 3292 2C65.tmp 141 PID 4616 wrote to memory of 4644 4616 2CE2.tmp 142 PID 4644 wrote to memory of 4724 4644 2D5F.tmp 143 PID 4724 wrote to memory of 1168 4724 2DDC.tmp 144 PID 1168 wrote to memory of 6024 1168 2E4A.tmp 145 PID 6024 wrote to memory of 4340 6024 2EB7.tmp 146 PID 4340 wrote to memory of 5420 4340 2F44.tmp 147 PID 5420 wrote to memory of 3792 5420 2FC1.tmp 148 PID 3792 wrote to memory of 3844 3792 303E.tmp 149 PID 3844 wrote to memory of 4148 3844 30AB.tmp 150 PID 4148 wrote to memory of 6100 4148 3118.tmp 151 PID 6100 wrote to memory of 1368 6100 3195.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_b5eed63a6bffe5bdabb62fe9b7b877f7_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_b5eed63a6bffe5bdabb62fe9b7b877f7_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\FD08.tmp"C:\Users\Admin\AppData\Local\Temp\FD08.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\FDB4.tmp"C:\Users\Admin\AppData\Local\Temp\FDB4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\FF1C.tmp"C:\Users\Admin\AppData\Local\Temp\FF1C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\44.tmp"C:\Users\Admin\AppData\Local\Temp\44.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5540 -
C:\Users\Admin\AppData\Local\Temp\16D.tmp"C:\Users\Admin\AppData\Local\Temp\16D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\1EA.tmp"C:\Users\Admin\AppData\Local\Temp\1EA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\371.tmp"C:\Users\Admin\AppData\Local\Temp\371.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\45B.tmp"C:\Users\Admin\AppData\Local\Temp\45B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\4C9.tmp"C:\Users\Admin\AppData\Local\Temp\4C9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\536.tmp"C:\Users\Admin\AppData\Local\Temp\536.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\72A.tmp"C:\Users\Admin\AppData\Local\Temp\72A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\863.tmp"C:\Users\Admin\AppData\Local\Temp\863.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\98B.tmp"C:\Users\Admin\AppData\Local\Temp\98B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\AD4.tmp"C:\Users\Admin\AppData\Local\Temp\AD4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Users\Admin\AppData\Local\Temp\BCE.tmp"C:\Users\Admin\AppData\Local\Temp\BCE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\CC8.tmp"C:\Users\Admin\AppData\Local\Temp\CC8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\D73.tmp"C:\Users\Admin\AppData\Local\Temp\D73.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\E8D.tmp"C:\Users\Admin\AppData\Local\Temp\E8D.tmp"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\FE4.tmp"C:\Users\Admin\AppData\Local\Temp\FE4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\10EE.tmp"C:\Users\Admin\AppData\Local\Temp\10EE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\11B9.tmp"C:\Users\Admin\AppData\Local\Temp\11B9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\1311.tmp"C:\Users\Admin\AppData\Local\Temp\1311.tmp"23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Users\Admin\AppData\Local\Temp\141B.tmp"C:\Users\Admin\AppData\Local\Temp\141B.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\1515.tmp"C:\Users\Admin\AppData\Local\Temp\1515.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\163D.tmp"C:\Users\Admin\AppData\Local\Temp\163D.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\1766.tmp"C:\Users\Admin\AppData\Local\Temp\1766.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\1860.tmp"C:\Users\Admin\AppData\Local\Temp\1860.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\1B7D.tmp"C:\Users\Admin\AppData\Local\Temp\1B7D.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\1CD5.tmp"C:\Users\Admin\AppData\Local\Temp\1CD5.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"C:\Users\Admin\AppData\Local\Temp\1DEE.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"C:\Users\Admin\AppData\Local\Temp\1EE8.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\1FB3.tmp"C:\Users\Admin\AppData\Local\Temp\1FB3.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\2050.tmp"C:\Users\Admin\AppData\Local\Temp\2050.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\20FB.tmp"C:\Users\Admin\AppData\Local\Temp\20FB.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\21C7.tmp"C:\Users\Admin\AppData\Local\Temp\21C7.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5488 -
C:\Users\Admin\AppData\Local\Temp\2292.tmp"C:\Users\Admin\AppData\Local\Temp\2292.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\237C.tmp"C:\Users\Admin\AppData\Local\Temp\237C.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\2428.tmp"C:\Users\Admin\AppData\Local\Temp\2428.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\2503.tmp"C:\Users\Admin\AppData\Local\Temp\2503.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\25DD.tmp"C:\Users\Admin\AppData\Local\Temp\25DD.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\2689.tmp"C:\Users\Admin\AppData\Local\Temp\2689.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\2764.tmp"C:\Users\Admin\AppData\Local\Temp\2764.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\282F.tmp"C:\Users\Admin\AppData\Local\Temp\282F.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\28DB.tmp"C:\Users\Admin\AppData\Local\Temp\28DB.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Users\Admin\AppData\Local\Temp\2977.tmp"C:\Users\Admin\AppData\Local\Temp\2977.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\2A42.tmp"C:\Users\Admin\AppData\Local\Temp\2A42.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\2AEE.tmp"C:\Users\Admin\AppData\Local\Temp\2AEE.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\2B6B.tmp"C:\Users\Admin\AppData\Local\Temp\2B6B.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\2BE8.tmp"C:\Users\Admin\AppData\Local\Temp\2BE8.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\2C65.tmp"C:\Users\Admin\AppData\Local\Temp\2C65.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\2CE2.tmp"C:\Users\Admin\AppData\Local\Temp\2CE2.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\2D5F.tmp"C:\Users\Admin\AppData\Local\Temp\2D5F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\2DDC.tmp"C:\Users\Admin\AppData\Local\Temp\2DDC.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\2E4A.tmp"C:\Users\Admin\AppData\Local\Temp\2E4A.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"C:\Users\Admin\AppData\Local\Temp\2EB7.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Users\Admin\AppData\Local\Temp\2F44.tmp"C:\Users\Admin\AppData\Local\Temp\2F44.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\2FC1.tmp"C:\Users\Admin\AppData\Local\Temp\2FC1.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5420 -
C:\Users\Admin\AppData\Local\Temp\303E.tmp"C:\Users\Admin\AppData\Local\Temp\303E.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\30AB.tmp"C:\Users\Admin\AppData\Local\Temp\30AB.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\3118.tmp"C:\Users\Admin\AppData\Local\Temp\3118.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\3195.tmp"C:\Users\Admin\AppData\Local\Temp\3195.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6100 -
C:\Users\Admin\AppData\Local\Temp\3212.tmp"C:\Users\Admin\AppData\Local\Temp\3212.tmp"65⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\328F.tmp"C:\Users\Admin\AppData\Local\Temp\328F.tmp"66⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\331C.tmp"C:\Users\Admin\AppData\Local\Temp\331C.tmp"67⤵PID:5668
-
C:\Users\Admin\AppData\Local\Temp\33A9.tmp"C:\Users\Admin\AppData\Local\Temp\33A9.tmp"68⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\3426.tmp"C:\Users\Admin\AppData\Local\Temp\3426.tmp"69⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\34A3.tmp"C:\Users\Admin\AppData\Local\Temp\34A3.tmp"70⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\3520.tmp"C:\Users\Admin\AppData\Local\Temp\3520.tmp"71⤵PID:5932
-
C:\Users\Admin\AppData\Local\Temp\359D.tmp"C:\Users\Admin\AppData\Local\Temp\359D.tmp"72⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\3639.tmp"C:\Users\Admin\AppData\Local\Temp\3639.tmp"73⤵PID:5260
-
C:\Users\Admin\AppData\Local\Temp\36B6.tmp"C:\Users\Admin\AppData\Local\Temp\36B6.tmp"74⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\3733.tmp"C:\Users\Admin\AppData\Local\Temp\3733.tmp"75⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\37B0.tmp"C:\Users\Admin\AppData\Local\Temp\37B0.tmp"76⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\381D.tmp"C:\Users\Admin\AppData\Local\Temp\381D.tmp"77⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\389A.tmp"C:\Users\Admin\AppData\Local\Temp\389A.tmp"78⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\3908.tmp"C:\Users\Admin\AppData\Local\Temp\3908.tmp"79⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\3975.tmp"C:\Users\Admin\AppData\Local\Temp\3975.tmp"80⤵PID:5952
-
C:\Users\Admin\AppData\Local\Temp\39F2.tmp"C:\Users\Admin\AppData\Local\Temp\39F2.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"C:\Users\Admin\AppData\Local\Temp\3A6F.tmp"82⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\3ADC.tmp"C:\Users\Admin\AppData\Local\Temp\3ADC.tmp"83⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\3B59.tmp"C:\Users\Admin\AppData\Local\Temp\3B59.tmp"84⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\3BE6.tmp"C:\Users\Admin\AppData\Local\Temp\3BE6.tmp"85⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\3C53.tmp"C:\Users\Admin\AppData\Local\Temp\3C53.tmp"86⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\3CB1.tmp"C:\Users\Admin\AppData\Local\Temp\3CB1.tmp"87⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\3D2E.tmp"C:\Users\Admin\AppData\Local\Temp\3D2E.tmp"88⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"89⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\3E09.tmp"C:\Users\Admin\AppData\Local\Temp\3E09.tmp"90⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"91⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"92⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\3F80.tmp"C:\Users\Admin\AppData\Local\Temp\3F80.tmp"93⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"94⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"95⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\40F7.tmp"C:\Users\Admin\AppData\Local\Temp\40F7.tmp"96⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"97⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\41F1.tmp"C:\Users\Admin\AppData\Local\Temp\41F1.tmp"98⤵PID:6124
-
C:\Users\Admin\AppData\Local\Temp\426E.tmp"C:\Users\Admin\AppData\Local\Temp\426E.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\42EB.tmp"C:\Users\Admin\AppData\Local\Temp\42EB.tmp"100⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\4358.tmp"C:\Users\Admin\AppData\Local\Temp\4358.tmp"101⤵PID:5896
-
C:\Users\Admin\AppData\Local\Temp\43C6.tmp"C:\Users\Admin\AppData\Local\Temp\43C6.tmp"102⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\4443.tmp"C:\Users\Admin\AppData\Local\Temp\4443.tmp"103⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\44C0.tmp"C:\Users\Admin\AppData\Local\Temp\44C0.tmp"104⤵PID:5176
-
C:\Users\Admin\AppData\Local\Temp\453D.tmp"C:\Users\Admin\AppData\Local\Temp\453D.tmp"105⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\45BA.tmp"C:\Users\Admin\AppData\Local\Temp\45BA.tmp"106⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\4627.tmp"C:\Users\Admin\AppData\Local\Temp\4627.tmp"107⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\4694.tmp"C:\Users\Admin\AppData\Local\Temp\4694.tmp"108⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\4711.tmp"C:\Users\Admin\AppData\Local\Temp\4711.tmp"109⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\478E.tmp"C:\Users\Admin\AppData\Local\Temp\478E.tmp"110⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\47FC.tmp"C:\Users\Admin\AppData\Local\Temp\47FC.tmp"111⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\4898.tmp"C:\Users\Admin\AppData\Local\Temp\4898.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\4905.tmp"C:\Users\Admin\AppData\Local\Temp\4905.tmp"113⤵PID:5252
-
C:\Users\Admin\AppData\Local\Temp\4992.tmp"C:\Users\Admin\AppData\Local\Temp\4992.tmp"114⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\49FF.tmp"C:\Users\Admin\AppData\Local\Temp\49FF.tmp"115⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\4A8C.tmp"C:\Users\Admin\AppData\Local\Temp\4A8C.tmp"116⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\4B67.tmp"C:\Users\Admin\AppData\Local\Temp\4B67.tmp"117⤵PID:5816
-
C:\Users\Admin\AppData\Local\Temp\4BF3.tmp"C:\Users\Admin\AppData\Local\Temp\4BF3.tmp"118⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\4C61.tmp"C:\Users\Admin\AppData\Local\Temp\4C61.tmp"119⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\4CDE.tmp"C:\Users\Admin\AppData\Local\Temp\4CDE.tmp"120⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\4D5B.tmp"C:\Users\Admin\AppData\Local\Temp\4D5B.tmp"121⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\4DD8.tmp"C:\Users\Admin\AppData\Local\Temp\4DD8.tmp"122⤵PID:2960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-