Analysis
- max time kernel
123s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 04:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_5e01af46f1defdf5cfcb6254cae7cec6_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_5e01af46f1defdf5cfcb6254cae7cec6_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-28_5e01af46f1defdf5cfcb6254cae7cec6_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260728-fd62baybnf
- SHA256 d16e6d0eb8e8c7dc4d57ad66c404db54adca09f48707e5c1172df9d9684774ad
- MD5 5e01af46f1defdf5cfcb6254cae7cec6
- SHA1 61bb4e92fabd60df9cc4ac937be5b60a45986af0
- SHA512 689cd894af5e89fc64889833c6a3534dda86f7cdee30e0eca6f91f036bdaf11fad3edd18c3a01fd5dfb4315958213a3bccb7f3375368772b690cbf9538416111
- SSDEEP 12288:wU5rCOTeiDyJDA7Hr5f67+wJHyCHA8IaMHNZ+3/v+I9hUG2VA:wUQOJDc8f8VSD8IaMHNGEA
- TLSH T144E4E12177D88536E5F7037859B5E6614D7EBD22A722D6CF2F8012AF1AB1BC08631723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 6036 26A9.tmp 1168 27D1.tmp 912 286E.tmp 4500 29B6.tmp 4188 2A81.tmp 3312 2B1D.tmp 5752 2C94.tmp 2240 2DCD.tmp 5524 2EA7.tmp 5784 2F92.tmp 3416 30AB.tmp 3656 3195.tmp 3264 32AF.tmp 2868 3399.tmp 2812 3493.tmp 5664 357D.tmp 4768 3677.tmp 2896 3791.tmp 2412 38E8.tmp 988 39C3.tmp 1128 3ABD.tmp 3232 3BA8.tmp 2504 3C92.tmp 1356 3DBB.tmp 2416 3F32.tmp 5464 405B.tmp 888 4184.tmp 4792 429D.tmp 5220 4397.tmp 2844 44B0.tmp 2184 455C.tmp 2324 45C9.tmp 1780 4666.tmp 5548 47EC.tmp 5960 48D7.tmp 3920 49C1.tmp 5912 4A9C.tmp 704 4B57.tmp 2760 4C13.tmp 5052 4CED.tmp 3340 4E07.tmp 3888 4EE1.tmp 5888 4FBC.tmp 5840 5058.tmp 5592 5152.tmp 5824 520E.tmp 4732 52C9.tmp 2488 53A4.tmp 5952 5440.tmp 5652 54DD.tmp 4720 5569.tmp 1916 5606.tmp 1976 5673.tmp 4632 570F.tmp 8 578C.tmp 1972 57FA.tmp 1064 5886.tmp 1724 58F4.tmp 5112 5971.tmp 4800 5A0D.tmp 5608 5AB9.tmp 1728 5B36.tmp 4240 5BA3.tmp 2848 5C20.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B24A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A03E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D661.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E19C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F35A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7749.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6821.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6865.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E72A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A692.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C564.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ED6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8687.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3399.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 423.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5886.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C191.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E092.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E11F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1474.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4056.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 157D.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1796 wrote to memory of 6036 1796 2026-07-28_5e01af46f1defdf5cfcb6254cae7cec6_elex_mafia_stealc_tofsee.exe 89 PID 6036 wrote to memory of 1168 6036 26A9.tmp 90 PID 1168 wrote to memory of 912 1168 27D1.tmp 91 PID 912 wrote to memory of 4500 912 286E.tmp 92 PID 4500 wrote to memory of 4188 4500 29B6.tmp 93 PID 4188 wrote to memory of 3312 4188 2A81.tmp 94 PID 3312 wrote to memory of 5752 3312 2B1D.tmp 95 PID 5752 wrote to memory of 2240 5752 2C94.tmp 96 PID 2240 wrote to memory of 5524 2240 2DCD.tmp 97 PID 5524 wrote to memory of 5784 5524 2EA7.tmp 98 PID 5784 wrote to memory of 3416 5784 2F92.tmp 99 PID 3416 wrote to memory of 3656 3416 30AB.tmp 100 PID 3656 wrote to memory of 3264 3656 3195.tmp 101 PID 3264 wrote to memory of 2868 3264 32AF.tmp 102 PID 2868 wrote to memory of 2812 2868 3399.tmp 103 PID 2812 wrote to memory of 5664 2812 3493.tmp 104 PID 5664 wrote to memory of 4768 5664 357D.tmp 105 PID 4768 wrote to memory of 2896 4768 3677.tmp 106 PID 2896 wrote to memory of 2412 2896 3791.tmp 107 PID 2412 wrote to memory of 988 2412 38E8.tmp 108 PID 988 wrote to memory of 1128 988 39C3.tmp 109 PID 1128 wrote to memory of 3232 1128 3ABD.tmp 110 PID 3232 wrote to memory of 2504 3232 3BA8.tmp 111 PID 2504 wrote to memory of 1356 2504 3C92.tmp 112 PID 1356 wrote to memory of 2416 1356 3DBB.tmp 113 PID 2416 wrote to memory of 5464 2416 3F32.tmp 114 PID 5464 wrote to memory of 888 5464 405B.tmp 115 PID 888 wrote to memory of 4792 888 4184.tmp 116 PID 4792 wrote to memory of 5220 4792 429D.tmp 117 PID 5220 wrote to memory of 2844 5220 4397.tmp 118 PID 2844 wrote to memory of 2184 2844 44B0.tmp 119 PID 2184 wrote to memory of 2324 2184 455C.tmp 120 PID 2324 wrote to memory of 1780 2324 45C9.tmp 121 PID 1780 wrote to memory of 5548 1780 4666.tmp 122 PID 5548 wrote to memory of 5960 5548 47EC.tmp 123 PID 5960 wrote to memory of 3920 5960 48D7.tmp 124 PID 3920 wrote to memory of 5912 3920 49C1.tmp 125 PID 5912 wrote to memory of 704 5912 4A9C.tmp 126 PID 704 wrote to memory of 2760 704 4B57.tmp 127 PID 2760 wrote to memory of 5052 2760 4C13.tmp 128 PID 5052 wrote to memory of 3340 5052 4CED.tmp 129 PID 3340 wrote to memory of 3888 3340 4E07.tmp 130 PID 3888 wrote to memory of 5888 3888 4EE1.tmp 131 PID 5888 wrote to memory of 5840 5888 4FBC.tmp 132 PID 5840 wrote to memory of 5592 5840 5058.tmp 133 PID 5592 wrote to memory of 5824 5592 5152.tmp 134 PID 5824 wrote to memory of 4732 5824 520E.tmp 135 PID 4732 wrote to memory of 2488 4732 52C9.tmp 136 PID 2488 wrote to memory of 5952 2488 53A4.tmp 137 PID 5952 wrote to memory of 5652 5952 5440.tmp 138 PID 5652 wrote to memory of 4720 5652 54DD.tmp 139 PID 4720 wrote to memory of 1916 4720 5569.tmp 140 PID 1916 wrote to memory of 1976 1916 5606.tmp 141 PID 1976 wrote to memory of 4632 1976 5673.tmp 142 PID 4632 wrote to memory of 8 4632 570F.tmp 143 PID 8 wrote to memory of 1972 8 578C.tmp 144 PID 1972 wrote to memory of 1064 1972 57FA.tmp 145 PID 1064 wrote to memory of 1724 1064 5886.tmp 146 PID 1724 wrote to memory of 5112 1724 58F4.tmp 147 PID 5112 wrote to memory of 4800 5112 5971.tmp 148 PID 4800 wrote to memory of 5608 4800 5A0D.tmp 149 PID 5608 wrote to memory of 1728 5608 5AB9.tmp 150 PID 1728 wrote to memory of 4240 1728 5B36.tmp 151 PID 4240 wrote to memory of 2848 4240 5BA3.tmp 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_5e01af46f1defdf5cfcb6254cae7cec6_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_5e01af46f1defdf5cfcb6254cae7cec6_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\26A9.tmp"C:\Users\Admin\AppData\Local\Temp\26A9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\27D1.tmp"C:\Users\Admin\AppData\Local\Temp\27D1.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\286E.tmp"C:\Users\Admin\AppData\Local\Temp\286E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\29B6.tmp"C:\Users\Admin\AppData\Local\Temp\29B6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\2A81.tmp"C:\Users\Admin\AppData\Local\Temp\2A81.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"C:\Users\Admin\AppData\Local\Temp\2B1D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\2C94.tmp"C:\Users\Admin\AppData\Local\Temp\2C94.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\2DCD.tmp"C:\Users\Admin\AppData\Local\Temp\2DCD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\2EA7.tmp"C:\Users\Admin\AppData\Local\Temp\2EA7.tmp"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5524 -
C:\Users\Admin\AppData\Local\Temp\2F92.tmp"C:\Users\Admin\AppData\Local\Temp\2F92.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5784 -
C:\Users\Admin\AppData\Local\Temp\30AB.tmp"C:\Users\Admin\AppData\Local\Temp\30AB.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\3195.tmp"C:\Users\Admin\AppData\Local\Temp\3195.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\32AF.tmp"C:\Users\Admin\AppData\Local\Temp\32AF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\3399.tmp"C:\Users\Admin\AppData\Local\Temp\3399.tmp"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\3493.tmp"C:\Users\Admin\AppData\Local\Temp\3493.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\357D.tmp"C:\Users\Admin\AppData\Local\Temp\357D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5664 -
C:\Users\Admin\AppData\Local\Temp\3677.tmp"C:\Users\Admin\AppData\Local\Temp\3677.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\3791.tmp"C:\Users\Admin\AppData\Local\Temp\3791.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\38E8.tmp"C:\Users\Admin\AppData\Local\Temp\38E8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\39C3.tmp"C:\Users\Admin\AppData\Local\Temp\39C3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Users\Admin\AppData\Local\Temp\3ABD.tmp"C:\Users\Admin\AppData\Local\Temp\3ABD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\3BA8.tmp"C:\Users\Admin\AppData\Local\Temp\3BA8.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\3C92.tmp"C:\Users\Admin\AppData\Local\Temp\3C92.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"C:\Users\Admin\AppData\Local\Temp\3DBB.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\3F32.tmp"C:\Users\Admin\AppData\Local\Temp\3F32.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\405B.tmp"C:\Users\Admin\AppData\Local\Temp\405B.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5464 -
C:\Users\Admin\AppData\Local\Temp\4184.tmp"C:\Users\Admin\AppData\Local\Temp\4184.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\429D.tmp"C:\Users\Admin\AppData\Local\Temp\429D.tmp"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\4397.tmp"C:\Users\Admin\AppData\Local\Temp\4397.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5220 -
C:\Users\Admin\AppData\Local\Temp\44B0.tmp"C:\Users\Admin\AppData\Local\Temp\44B0.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\455C.tmp"C:\Users\Admin\AppData\Local\Temp\455C.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\45C9.tmp"C:\Users\Admin\AppData\Local\Temp\45C9.tmp"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\4666.tmp"C:\Users\Admin\AppData\Local\Temp\4666.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\47EC.tmp"C:\Users\Admin\AppData\Local\Temp\47EC.tmp"35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5548 -
C:\Users\Admin\AppData\Local\Temp\48D7.tmp"C:\Users\Admin\AppData\Local\Temp\48D7.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5960 -
C:\Users\Admin\AppData\Local\Temp\49C1.tmp"C:\Users\Admin\AppData\Local\Temp\49C1.tmp"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\4A9C.tmp"C:\Users\Admin\AppData\Local\Temp\4A9C.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\4B57.tmp"C:\Users\Admin\AppData\Local\Temp\4B57.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Users\Admin\AppData\Local\Temp\4C13.tmp"C:\Users\Admin\AppData\Local\Temp\4C13.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\4CED.tmp"C:\Users\Admin\AppData\Local\Temp\4CED.tmp"41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\4E07.tmp"C:\Users\Admin\AppData\Local\Temp\4E07.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"C:\Users\Admin\AppData\Local\Temp\4EE1.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\4FBC.tmp"C:\Users\Admin\AppData\Local\Temp\4FBC.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\5058.tmp"C:\Users\Admin\AppData\Local\Temp\5058.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Users\Admin\AppData\Local\Temp\5152.tmp"C:\Users\Admin\AppData\Local\Temp\5152.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5592 -
C:\Users\Admin\AppData\Local\Temp\520E.tmp"C:\Users\Admin\AppData\Local\Temp\520E.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
C:\Users\Admin\AppData\Local\Temp\52C9.tmp"C:\Users\Admin\AppData\Local\Temp\52C9.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\53A4.tmp"C:\Users\Admin\AppData\Local\Temp\53A4.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\5440.tmp"C:\Users\Admin\AppData\Local\Temp\5440.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
C:\Users\Admin\AppData\Local\Temp\54DD.tmp"C:\Users\Admin\AppData\Local\Temp\54DD.tmp"51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\5569.tmp"C:\Users\Admin\AppData\Local\Temp\5569.tmp"52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\5606.tmp"C:\Users\Admin\AppData\Local\Temp\5606.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\5673.tmp"C:\Users\Admin\AppData\Local\Temp\5673.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\570F.tmp"C:\Users\Admin\AppData\Local\Temp\570F.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\578C.tmp"C:\Users\Admin\AppData\Local\Temp\578C.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Users\Admin\AppData\Local\Temp\57FA.tmp"C:\Users\Admin\AppData\Local\Temp\57FA.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\5886.tmp"C:\Users\Admin\AppData\Local\Temp\5886.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\58F4.tmp"C:\Users\Admin\AppData\Local\Temp\58F4.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\5971.tmp"C:\Users\Admin\AppData\Local\Temp\5971.tmp"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"C:\Users\Admin\AppData\Local\Temp\5A0D.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\5AB9.tmp"C:\Users\Admin\AppData\Local\Temp\5AB9.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5608 -
C:\Users\Admin\AppData\Local\Temp\5B36.tmp"C:\Users\Admin\AppData\Local\Temp\5B36.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\5BA3.tmp"C:\Users\Admin\AppData\Local\Temp\5BA3.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\5C20.tmp"C:\Users\Admin\AppData\Local\Temp\5C20.tmp"65⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\5CAD.tmp"C:\Users\Admin\AppData\Local\Temp\5CAD.tmp"66⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\5D1A.tmp"C:\Users\Admin\AppData\Local\Temp\5D1A.tmp"67⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\5D87.tmp"C:\Users\Admin\AppData\Local\Temp\5D87.tmp"68⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\5E04.tmp"C:\Users\Admin\AppData\Local\Temp\5E04.tmp"69⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\5EB0.tmp"C:\Users\Admin\AppData\Local\Temp\5EB0.tmp"70⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"C:\Users\Admin\AppData\Local\Temp\5F3D.tmp"71⤵PID:240
-
C:\Users\Admin\AppData\Local\Temp\5FCA.tmp"C:\Users\Admin\AppData\Local\Temp\5FCA.tmp"72⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\6047.tmp"C:\Users\Admin\AppData\Local\Temp\6047.tmp"73⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\60D3.tmp"C:\Users\Admin\AppData\Local\Temp\60D3.tmp"74⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\6150.tmp"C:\Users\Admin\AppData\Local\Temp\6150.tmp"75⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\61DD.tmp"C:\Users\Admin\AppData\Local\Temp\61DD.tmp"76⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\6289.tmp"C:\Users\Admin\AppData\Local\Temp\6289.tmp"77⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\6306.tmp"C:\Users\Admin\AppData\Local\Temp\6306.tmp"78⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\6383.tmp"C:\Users\Admin\AppData\Local\Temp\6383.tmp"79⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\640F.tmp"C:\Users\Admin\AppData\Local\Temp\640F.tmp"80⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\649C.tmp"C:\Users\Admin\AppData\Local\Temp\649C.tmp"81⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\6519.tmp"C:\Users\Admin\AppData\Local\Temp\6519.tmp"82⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\65A6.tmp"C:\Users\Admin\AppData\Local\Temp\65A6.tmp"83⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\6632.tmp"C:\Users\Admin\AppData\Local\Temp\6632.tmp"84⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\66CE.tmp"C:\Users\Admin\AppData\Local\Temp\66CE.tmp"85⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\675B.tmp"C:\Users\Admin\AppData\Local\Temp\675B.tmp"86⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\67F7.tmp"C:\Users\Admin\AppData\Local\Temp\67F7.tmp"87⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\6865.tmp"C:\Users\Admin\AppData\Local\Temp\6865.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\68E2.tmp"C:\Users\Admin\AppData\Local\Temp\68E2.tmp"89⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\697E.tmp"C:\Users\Admin\AppData\Local\Temp\697E.tmp"90⤵PID:6068
-
C:\Users\Admin\AppData\Local\Temp\69FB.tmp"C:\Users\Admin\AppData\Local\Temp\69FB.tmp"91⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\6A88.tmp"C:\Users\Admin\AppData\Local\Temp\6A88.tmp"92⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\6B05.tmp"C:\Users\Admin\AppData\Local\Temp\6B05.tmp"93⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\6B91.tmp"C:\Users\Admin\AppData\Local\Temp\6B91.tmp"94⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"C:\Users\Admin\AppData\Local\Temp\6C0E.tmp"95⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"C:\Users\Admin\AppData\Local\Temp\6CAA.tmp"96⤵PID:5984
-
C:\Users\Admin\AppData\Local\Temp\6D37.tmp"C:\Users\Admin\AppData\Local\Temp\6D37.tmp"97⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"C:\Users\Admin\AppData\Local\Temp\6DB4.tmp"98⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\6E41.tmp"C:\Users\Admin\AppData\Local\Temp\6E41.tmp"99⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\6ECD.tmp"C:\Users\Admin\AppData\Local\Temp\6ECD.tmp"100⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\6F5A.tmp"C:\Users\Admin\AppData\Local\Temp\6F5A.tmp"101⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\6FD7.tmp"C:\Users\Admin\AppData\Local\Temp\6FD7.tmp"102⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\7064.tmp"C:\Users\Admin\AppData\Local\Temp\7064.tmp"103⤵PID:5344
-
C:\Users\Admin\AppData\Local\Temp\70F0.tmp"C:\Users\Admin\AppData\Local\Temp\70F0.tmp"104⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\718C.tmp"C:\Users\Admin\AppData\Local\Temp\718C.tmp"105⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\7219.tmp"C:\Users\Admin\AppData\Local\Temp\7219.tmp"106⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\72C5.tmp"C:\Users\Admin\AppData\Local\Temp\72C5.tmp"107⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\7332.tmp"C:\Users\Admin\AppData\Local\Temp\7332.tmp"108⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\73BF.tmp"C:\Users\Admin\AppData\Local\Temp\73BF.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\744C.tmp"C:\Users\Admin\AppData\Local\Temp\744C.tmp"110⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\74D8.tmp"C:\Users\Admin\AppData\Local\Temp\74D8.tmp"111⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\7565.tmp"C:\Users\Admin\AppData\Local\Temp\7565.tmp"112⤵PID:5364
-
C:\Users\Admin\AppData\Local\Temp\75E2.tmp"C:\Users\Admin\AppData\Local\Temp\75E2.tmp"113⤵PID:5412
-
C:\Users\Admin\AppData\Local\Temp\766E.tmp"C:\Users\Admin\AppData\Local\Temp\766E.tmp"114⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\76DC.tmp"C:\Users\Admin\AppData\Local\Temp\76DC.tmp"115⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\7749.tmp"C:\Users\Admin\AppData\Local\Temp\7749.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\77C6.tmp"C:\Users\Admin\AppData\Local\Temp\77C6.tmp"117⤵PID:5996
-
C:\Users\Admin\AppData\Local\Temp\7843.tmp"C:\Users\Admin\AppData\Local\Temp\7843.tmp"118⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\78FF.tmp"C:\Users\Admin\AppData\Local\Temp\78FF.tmp"119⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\796C.tmp"C:\Users\Admin\AppData\Local\Temp\796C.tmp"120⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\79F9.tmp"C:\Users\Admin\AppData\Local\Temp\79F9.tmp"121⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\7A76.tmp"C:\Users\Admin\AppData\Local\Temp\7A76.tmp"122⤵PID:4204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-