Analysis
- max time kernel
121s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 10:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_3391004a37555814db66a02824a24c88_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_3391004a37555814db66a02824a24c88_elex_mafia_stealc_tofsee.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-28_3391004a37555814db66a02824a24c88_elex_mafia_stealc_tofsee.exe
- Size 652KB
- Sample260728-l3amastgla
- SHA256 75d9554dd0bde65b1b861fab4de0f7a19c894d7fac0decf3b03749523ded49b9
- MD5 3391004a37555814db66a02824a24c88
- SHA1 dca3a2a5fcfe804a41a782391ade3256e491593a
- SHA512 ebd3d91cee1655e072a10e6f8c6e7723c592d69a95c2708a1881726e829f3b8cfe07cf56dfda7d7f9f8a4917892394a6068eaddf531f843417926a3b0a6f2a6f
- SSDEEP 12288:wU5rCOTeiDRTRyzqRIjHnRTNZ+3/v+I9hUG2VA:wUQOJDRTRyzuIjxTNGEA
- TLSH T1ACE4D12177D8C536E5FB037859B5E6644A7EBD32A722D6CF2F8015AE0971BC08A31723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3464 EA95.tmp 3184 EB41.tmp 5904 EBAE.tmp 5516 ED44.tmp 4232 EE00.tmp 4148 EEAC.tmp 2832 EFC5.tmp 5392 F0CF.tmp 4484 F1D8.tmp 5920 F2F1.tmp 4088 F41A.tmp 2808 F4F5.tmp 5152 F5EF.tmp 5688 F708.tmp 4116 F831.tmp 5100 F92B.tmp 5032 FA25.tmp 472 FB3E.tmp 2456 FC77.tmp 3844 FD71.tmp 3460 FE7B.tmp 2488 FF55.tmp 5768 4F.tmp 2956 13A.tmp 3932 243.tmp 4436 31E.tmp 2072 457.tmp 2244 541.tmp 5596 61C.tmp 2160 745.tmp 4632 84E.tmp 2684 958.tmp 4812 A23.tmp 4900 AB0.tmp 4556 B4C.tmp 932 C07.tmp 5372 CC3.tmp 4480 D6F.tmp 2504 E2A.tmp 1228 F05.tmp 2016 FB1.tmp 4024 106C.tmp 3940 1128.tmp 4384 11A5.tmp 4464 1251.tmp 5968 12DD.tmp 4668 1399.tmp 3684 1464.tmp 3456 152F.tmp 4676 15BC.tmp 5916 16B6.tmp 5728 1723.tmp 3472 17B0.tmp 4064 184C.tmp 124 18B9.tmp 2432 1975.tmp 4016 1A01.tmp 3116 1A7E.tmp 4696 1AEC.tmp 3620 1B59.tmp 204 1BF5.tmp 4640 1C72.tmp 848 1CEF.tmp 5044 1D6C.tmp - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8907.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 541.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 958.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4864.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 319C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F92B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A092.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A797.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 734D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7159.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9972.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E12A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 387.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 921B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 969F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BDB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 559E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6696.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 821D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2452.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 379C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3219.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 583E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3450.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 880D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A99F.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5980 wrote to memory of 3464 5980 2026-07-28_3391004a37555814db66a02824a24c88_elex_mafia_stealc_tofsee.exe 89 PID 3464 wrote to memory of 3184 3464 EA95.tmp 90 PID 3184 wrote to memory of 5904 3184 EB41.tmp 91 PID 5904 wrote to memory of 5516 5904 EBAE.tmp 92 PID 5516 wrote to memory of 4232 5516 ED44.tmp 93 PID 4232 wrote to memory of 4148 4232 EE00.tmp 94 PID 4148 wrote to memory of 2832 4148 EEAC.tmp 95 PID 2832 wrote to memory of 5392 2832 EFC5.tmp 96 PID 5392 wrote to memory of 4484 5392 F0CF.tmp 97 PID 4484 wrote to memory of 5920 4484 F1D8.tmp 98 PID 5920 wrote to memory of 4088 5920 F2F1.tmp 99 PID 4088 wrote to memory of 2808 4088 F41A.tmp 100 PID 2808 wrote to memory of 5152 2808 F4F5.tmp 101 PID 5152 wrote to memory of 5688 5152 F5EF.tmp 102 PID 5688 wrote to memory of 4116 5688 F708.tmp 103 PID 4116 wrote to memory of 5100 4116 F831.tmp 104 PID 5100 wrote to memory of 5032 5100 F92B.tmp 105 PID 5032 wrote to memory of 472 5032 FA25.tmp 106 PID 472 wrote to memory of 2456 472 FB3E.tmp 107 PID 2456 wrote to memory of 3844 2456 FC77.tmp 108 PID 3844 wrote to memory of 3460 3844 FD71.tmp 109 PID 3460 wrote to memory of 2488 3460 FE7B.tmp 110 PID 2488 wrote to memory of 5768 2488 FF55.tmp 111 PID 5768 wrote to memory of 2956 5768 4F.tmp 112 PID 2956 wrote to memory of 3932 2956 13A.tmp 113 PID 3932 wrote to memory of 4436 3932 243.tmp 114 PID 4436 wrote to memory of 2072 4436 31E.tmp 115 PID 2072 wrote to memory of 2244 2072 457.tmp 116 PID 2244 wrote to memory of 5596 2244 541.tmp 117 PID 5596 wrote to memory of 2160 5596 61C.tmp 118 PID 2160 wrote to memory of 4632 2160 745.tmp 119 PID 4632 wrote to memory of 2684 4632 84E.tmp 120 PID 2684 wrote to memory of 4812 2684 958.tmp 121 PID 4812 wrote to memory of 4900 4812 A23.tmp 122 PID 4900 wrote to memory of 4556 4900 AB0.tmp 123 PID 4556 wrote to memory of 932 4556 B4C.tmp 124 PID 932 wrote to memory of 5372 932 C07.tmp 125 PID 5372 wrote to memory of 4480 5372 CC3.tmp 126 PID 4480 wrote to memory of 2504 4480 D6F.tmp 127 PID 2504 wrote to memory of 1228 2504 E2A.tmp 128 PID 1228 wrote to memory of 2016 1228 F05.tmp 129 PID 2016 wrote to memory of 4024 2016 FB1.tmp 130 PID 4024 wrote to memory of 3940 4024 106C.tmp 131 PID 3940 wrote to memory of 4384 3940 1128.tmp 132 PID 4384 wrote to memory of 4464 4384 11A5.tmp 133 PID 4464 wrote to memory of 5968 4464 1251.tmp 134 PID 5968 wrote to memory of 4668 5968 12DD.tmp 135 PID 4668 wrote to memory of 3684 4668 1399.tmp 136 PID 3684 wrote to memory of 3456 3684 1464.tmp 137 PID 3456 wrote to memory of 4676 3456 152F.tmp 138 PID 3708 wrote to memory of 5916 3708 1629.tmp 140 PID 5916 wrote to memory of 5728 5916 16B6.tmp 141 PID 5728 wrote to memory of 3472 5728 1723.tmp 142 PID 3472 wrote to memory of 4064 3472 17B0.tmp 143 PID 4064 wrote to memory of 124 4064 184C.tmp 144 PID 124 wrote to memory of 2432 124 18B9.tmp 145 PID 2432 wrote to memory of 4016 2432 1975.tmp 146 PID 4016 wrote to memory of 3116 4016 1A01.tmp 147 PID 3116 wrote to memory of 4696 3116 1A7E.tmp 148 PID 4696 wrote to memory of 3620 4696 1AEC.tmp 149 PID 3620 wrote to memory of 204 3620 1B59.tmp 150 PID 204 wrote to memory of 4640 204 1BF5.tmp 151 PID 4640 wrote to memory of 848 4640 1C72.tmp 152 PID 848 wrote to memory of 5044 848 1CEF.tmp 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_3391004a37555814db66a02824a24c88_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_3391004a37555814db66a02824a24c88_elex_mafia_stealc_tofsee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\EA95.tmp"C:\Users\Admin\AppData\Local\Temp\EA95.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\EB41.tmp"C:\Users\Admin\AppData\Local\Temp\EB41.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\EBAE.tmp"C:\Users\Admin\AppData\Local\Temp\EBAE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Users\Admin\AppData\Local\Temp\ED44.tmp"C:\Users\Admin\AppData\Local\Temp\ED44.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5516 -
C:\Users\Admin\AppData\Local\Temp\EE00.tmp"C:\Users\Admin\AppData\Local\Temp\EE00.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"C:\Users\Admin\AppData\Local\Temp\EEAC.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\EFC5.tmp"C:\Users\Admin\AppData\Local\Temp\EFC5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\F0CF.tmp"C:\Users\Admin\AppData\Local\Temp\F0CF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5392 -
C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"C:\Users\Admin\AppData\Local\Temp\F1D8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\F2F1.tmp"C:\Users\Admin\AppData\Local\Temp\F2F1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Temp\F41A.tmp"C:\Users\Admin\AppData\Local\Temp\F41A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\F4F5.tmp"C:\Users\Admin\AppData\Local\Temp\F4F5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\F5EF.tmp"C:\Users\Admin\AppData\Local\Temp\F5EF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Users\Admin\AppData\Local\Temp\F708.tmp"C:\Users\Admin\AppData\Local\Temp\F708.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\F831.tmp"C:\Users\Admin\AppData\Local\Temp\F831.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\F92B.tmp"C:\Users\Admin\AppData\Local\Temp\F92B.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\FA25.tmp"C:\Users\Admin\AppData\Local\Temp\FA25.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"C:\Users\Admin\AppData\Local\Temp\FB3E.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Users\Admin\AppData\Local\Temp\FC77.tmp"C:\Users\Admin\AppData\Local\Temp\FC77.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\FD71.tmp"C:\Users\Admin\AppData\Local\Temp\FD71.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\FF55.tmp"C:\Users\Admin\AppData\Local\Temp\FF55.tmp"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\4F.tmp"C:\Users\Admin\AppData\Local\Temp\4F.tmp"24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5768 -
C:\Users\Admin\AppData\Local\Temp\13A.tmp"C:\Users\Admin\AppData\Local\Temp\13A.tmp"25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\243.tmp"C:\Users\Admin\AppData\Local\Temp\243.tmp"26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\31E.tmp"C:\Users\Admin\AppData\Local\Temp\31E.tmp"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\457.tmp"C:\Users\Admin\AppData\Local\Temp\457.tmp"28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\541.tmp"C:\Users\Admin\AppData\Local\Temp\541.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\61C.tmp"C:\Users\Admin\AppData\Local\Temp\61C.tmp"30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Users\Admin\AppData\Local\Temp\745.tmp"C:\Users\Admin\AppData\Local\Temp\745.tmp"31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\84E.tmp"C:\Users\Admin\AppData\Local\Temp\84E.tmp"32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\958.tmp"C:\Users\Admin\AppData\Local\Temp\958.tmp"33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\A23.tmp"C:\Users\Admin\AppData\Local\Temp\A23.tmp"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\AB0.tmp"C:\Users\Admin\AppData\Local\Temp\AB0.tmp"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\B4C.tmp"C:\Users\Admin\AppData\Local\Temp\B4C.tmp"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\C07.tmp"C:\Users\Admin\AppData\Local\Temp\C07.tmp"37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\CC3.tmp"C:\Users\Admin\AppData\Local\Temp\CC3.tmp"38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5372 -
C:\Users\Admin\AppData\Local\Temp\D6F.tmp"C:\Users\Admin\AppData\Local\Temp\D6F.tmp"39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\E2A.tmp"C:\Users\Admin\AppData\Local\Temp\E2A.tmp"40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\F05.tmp"C:\Users\Admin\AppData\Local\Temp\F05.tmp"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\FB1.tmp"C:\Users\Admin\AppData\Local\Temp\FB1.tmp"42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\106C.tmp"C:\Users\Admin\AppData\Local\Temp\106C.tmp"43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\1128.tmp"C:\Users\Admin\AppData\Local\Temp\1128.tmp"44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\11A5.tmp"C:\Users\Admin\AppData\Local\Temp\11A5.tmp"45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\1251.tmp"C:\Users\Admin\AppData\Local\Temp\1251.tmp"46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\12DD.tmp"C:\Users\Admin\AppData\Local\Temp\12DD.tmp"47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5968 -
C:\Users\Admin\AppData\Local\Temp\1399.tmp"C:\Users\Admin\AppData\Local\Temp\1399.tmp"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\1464.tmp"C:\Users\Admin\AppData\Local\Temp\1464.tmp"49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\152F.tmp"C:\Users\Admin\AppData\Local\Temp\152F.tmp"50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\15BC.tmp"C:\Users\Admin\AppData\Local\Temp\15BC.tmp"51⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\1629.tmp"C:\Users\Admin\AppData\Local\Temp\1629.tmp"52⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\16B6.tmp"C:\Users\Admin\AppData\Local\Temp\16B6.tmp"53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5916 -
C:\Users\Admin\AppData\Local\Temp\1723.tmp"C:\Users\Admin\AppData\Local\Temp\1723.tmp"54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Users\Admin\AppData\Local\Temp\17B0.tmp"C:\Users\Admin\AppData\Local\Temp\17B0.tmp"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\184C.tmp"C:\Users\Admin\AppData\Local\Temp\184C.tmp"56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\18B9.tmp"C:\Users\Admin\AppData\Local\Temp\18B9.tmp"57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:124 -
C:\Users\Admin\AppData\Local\Temp\1975.tmp"C:\Users\Admin\AppData\Local\Temp\1975.tmp"58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\1A01.tmp"C:\Users\Admin\AppData\Local\Temp\1A01.tmp"59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\1A7E.tmp"C:\Users\Admin\AppData\Local\Temp\1A7E.tmp"60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\1AEC.tmp"C:\Users\Admin\AppData\Local\Temp\1AEC.tmp"61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\1B59.tmp"C:\Users\Admin\AppData\Local\Temp\1B59.tmp"62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\1BF5.tmp"C:\Users\Admin\AppData\Local\Temp\1BF5.tmp"63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Users\Admin\AppData\Local\Temp\1C72.tmp"C:\Users\Admin\AppData\Local\Temp\1C72.tmp"64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"C:\Users\Admin\AppData\Local\Temp\1CEF.tmp"65⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"C:\Users\Admin\AppData\Local\Temp\1D6C.tmp"66⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\1DE9.tmp"C:\Users\Admin\AppData\Local\Temp\1DE9.tmp"67⤵PID:5520
-
C:\Users\Admin\AppData\Local\Temp\1E57.tmp"C:\Users\Admin\AppData\Local\Temp\1E57.tmp"68⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"C:\Users\Admin\AppData\Local\Temp\1EE3.tmp"69⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\1F70.tmp"C:\Users\Admin\AppData\Local\Temp\1F70.tmp"70⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\1FFD.tmp"C:\Users\Admin\AppData\Local\Temp\1FFD.tmp"71⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\205A.tmp"C:\Users\Admin\AppData\Local\Temp\205A.tmp"72⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\20E7.tmp"C:\Users\Admin\AppData\Local\Temp\20E7.tmp"73⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\2154.tmp"C:\Users\Admin\AppData\Local\Temp\2154.tmp"74⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\21D1.tmp"C:\Users\Admin\AppData\Local\Temp\21D1.tmp"75⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\224E.tmp"C:\Users\Admin\AppData\Local\Temp\224E.tmp"76⤵PID:5140
-
C:\Users\Admin\AppData\Local\Temp\22CB.tmp"C:\Users\Admin\AppData\Local\Temp\22CB.tmp"77⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"78⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"79⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"81⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\258B.tmp"C:\Users\Admin\AppData\Local\Temp\258B.tmp"82⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"83⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\26A4.tmp"C:\Users\Admin\AppData\Local\Temp\26A4.tmp"84⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"85⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\27BD.tmp"C:\Users\Admin\AppData\Local\Temp\27BD.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\284A.tmp"C:\Users\Admin\AppData\Local\Temp\284A.tmp"87⤵PID:200
-
C:\Users\Admin\AppData\Local\Temp\28C7.tmp"C:\Users\Admin\AppData\Local\Temp\28C7.tmp"88⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\2953.tmp"C:\Users\Admin\AppData\Local\Temp\2953.tmp"89⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\29F0.tmp"C:\Users\Admin\AppData\Local\Temp\29F0.tmp"90⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\2A7C.tmp"C:\Users\Admin\AppData\Local\Temp\2A7C.tmp"91⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"C:\Users\Admin\AppData\Local\Temp\2AF9.tmp"92⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\2B76.tmp"C:\Users\Admin\AppData\Local\Temp\2B76.tmp"93⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\2BF3.tmp"C:\Users\Admin\AppData\Local\Temp\2BF3.tmp"94⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\2C70.tmp"C:\Users\Admin\AppData\Local\Temp\2C70.tmp"95⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\2D0C.tmp"C:\Users\Admin\AppData\Local\Temp\2D0C.tmp"96⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\2D99.tmp"C:\Users\Admin\AppData\Local\Temp\2D99.tmp"97⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\2E16.tmp"C:\Users\Admin\AppData\Local\Temp\2E16.tmp"98⤵PID:5796
-
C:\Users\Admin\AppData\Local\Temp\2E93.tmp"C:\Users\Admin\AppData\Local\Temp\2E93.tmp"99⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\2F20.tmp"C:\Users\Admin\AppData\Local\Temp\2F20.tmp"100⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"C:\Users\Admin\AppData\Local\Temp\2F9D.tmp"101⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\3029.tmp"C:\Users\Admin\AppData\Local\Temp\3029.tmp"102⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\30A6.tmp"C:\Users\Admin\AppData\Local\Temp\30A6.tmp"103⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\3133.tmp"C:\Users\Admin\AppData\Local\Temp\3133.tmp"104⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\31C0.tmp"C:\Users\Admin\AppData\Local\Temp\31C0.tmp"105⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\324C.tmp"C:\Users\Admin\AppData\Local\Temp\324C.tmp"106⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\32E8.tmp"C:\Users\Admin\AppData\Local\Temp\32E8.tmp"107⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\3356.tmp"C:\Users\Admin\AppData\Local\Temp\3356.tmp"108⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\33C3.tmp"C:\Users\Admin\AppData\Local\Temp\33C3.tmp"109⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\3450.tmp"C:\Users\Admin\AppData\Local\Temp\3450.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\34DC.tmp"C:\Users\Admin\AppData\Local\Temp\34DC.tmp"111⤵PID:5880
-
C:\Users\Admin\AppData\Local\Temp\3569.tmp"C:\Users\Admin\AppData\Local\Temp\3569.tmp"112⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\35E6.tmp"C:\Users\Admin\AppData\Local\Temp\35E6.tmp"113⤵PID:5908
-
C:\Users\Admin\AppData\Local\Temp\3682.tmp"C:\Users\Admin\AppData\Local\Temp\3682.tmp"114⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\370F.tmp"C:\Users\Admin\AppData\Local\Temp\370F.tmp"115⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\379C.tmp"C:\Users\Admin\AppData\Local\Temp\379C.tmp"116⤵
- System Location Discovery: System Language Discovery
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\3819.tmp"C:\Users\Admin\AppData\Local\Temp\3819.tmp"117⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\3896.tmp"C:\Users\Admin\AppData\Local\Temp\3896.tmp"118⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\3922.tmp"C:\Users\Admin\AppData\Local\Temp\3922.tmp"119⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\3990.tmp"C:\Users\Admin\AppData\Local\Temp\3990.tmp"120⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\39FD.tmp"C:\Users\Admin\AppData\Local\Temp\39FD.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\3A8A.tmp"C:\Users\Admin\AppData\Local\Temp\3A8A.tmp"122⤵PID:5740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-